CR95HF 



13.56-MHz multi-protocol contactless transceiver 1C 

with SPI and UART serial access 


Datasheet - production data 



VFQFPN32 (5x5 mm) 


Features 

• CR95HF belongs to the ST25 family which 
includes all ST's NFC/RFID tag and reader 
products 

• Operating modes supported: 

- Reader/Writer 

• Hardware features 

- Dedicated internal frame controller 

- Highly integrated Analog Front End (AFE) 
for RF communications 

- Transmission and reception modes 

- Optimized power management 

- Tag Detection mode 

• RF communication @13.56 MHz 

- ISO/IEC 14443 Type A and B 

- ISO/IEC 15693 

- ISO/IEC 18092 

- MIFARE® Classic compatible 


• Communication interfaces with a Host 
Controller 

- Serial peripheral interface (SPI) Slave 
interface 

- Universal asynchronous 
receiver/transmitter (UART) 

- Up to 528-byte command/reception buffer 
(FIFO) 

• 32-lead, 5x5 mm, very thin fine pitch quad flat 
(VFOFPN) ECOPACK®2 package 

Applications 

Typical protocols supported: 

• ISO/IEC 14443-3 Type A and B tags 

• ISO/IEC 15693 tags 

• ISO/IEC 18000-3M1 tags 

• NFC Forum tags: Types 1,2,3 and 4 

• ST short-range interface (SRI) tags 

• ST long-range interface (LRI) tags 

• ST Dual Interface EEPROM 


a. MIFARE and MIFARE Classic are registered 
trademarks of NXP B.V. and are used under license. 

b. Parity Framing mode is compatible with 
MIFARE® Classic requirements. Flowever, access to 
Authenticated state must be supported by an external 
secure host which embeds the MIFARE® Classic 
library. 
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Description 


1 Description 


The CR95HF is an integrated transceiver 1C for contactless applications. 

The CR95HF manages frame coding and decoding in Reader mode for standard 
applications such as near field communication (NFC), proximity and vicinity standards. 

The CR95HF embeds an Analog Front End to provide the 13.56 MHz Air Interface. 

The CR95HF supports ISO/IEC 14443 Type A and B, ISO/IEC 15693 (single or double 
subcarrier) and ISO/IEC 18092 communication protocols. 

The CR95HF also supports the detection, reading and writing of NFC Forum Type 1,2,3 
and 4 tags. 


Figure 1. CR95HF application overview 
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1.1 Block diagram 


Figure 2. CR95HF block diagram 
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1.2 


List of terms 


Table 1. List of terms 


Term 

Meaning 

DAC 

Digital analog converter 

GND 

Ground 

HFO 

High frequency oscillator 

LFO 

Low frequency oscillator 

MCU 

Microcontroller unit 

NFC 

Near Field Communication 

RFID 

Radio Frequency Identification 

RFU 

Reserved for future use 

SPI 

Serial peripheral interface 

t L 

Low frequency period 

tREF 

Reference time 

UART 

Universal asynchronous receiver-transmitter 

WFE 

Wait For Event 
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Pin and signal descriptions 


2 Pin and signal descriptions 


Figure 3. CR95HF pinout description 
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Table 2. CR95HF pin descriptions 


Pin 

Pin name 

Type* 1 * 

Main function 

Alternate function 

1 

TX1 

0 

Driver output 1 


2 

TX2 

0 

Driver output 2 


3 

NC 


Not connected 


4 

NC 


Not connected 


5 

RX1 

1 

Receiver input 1 


6 

RX2 

1 

Receiver input 2 


7 

NC 


Not connected 


8 

GNDRX 

P 

Ground (analog) 


9 

ST_R0 

0 

ST Reserved* 2 ) 


10 

NC 


Not connected 


11 

NC 


Not connected 




DoclD018669 Rev 12 


9/77 
































Pin and signal descriptions 


CR95HF 


Table 2. CR95HF pin descriptions (continued) 


Pin 

Pin name 

Type* 1 * 

Main function 

Alternate function 

12 

UART_RX / IRQJN 

| (3) 

UART receive pin * 4 ) 

Interrupt input 

13 

VPS 

P 

Main power supply 

- 

14 

UART_TX / IRQ_OUT 

0*5) 

UART transmit pin 

Interrupt output 

15 

SPI_SS 

| (6) 

SPI Slave Select (active low) 

- 

16 

SPI_MISO 

0*6) 

SPI Data, Slave Output 

- 

17 

SPI_MOSI 

| (6) 

SPI Data, Slave Input * 6 ) 

- 

18 

SPI_SCK 

|(7) 

SPI serial clock 

- 

19 

SSI_0 

| (6) 

Select serial communication 
interface 

- 

20 

SSI_1 

| (6) 

Select serial communication 
interface 

- 

21 

ST_R1 

| (8) 

ST Reserved 

- 

22 

GND 

P 

Ground (digital) 

- 

23 

NC 

- 

Not connected 

- 

24 

NC 

- 

Not connected 

- 

25 

NC 

- 

Not connected 

- 

26 

NC 

- 

Not connected 

- 

27 

NC 

- 

Not connected 

- 

28 

NC 

- 

Not connected 

- 

29 

XIN 

- 

Crystal oscillator input 

- 

30 

XOUT 

- 

Crystal oscillator output 

- 

31 

GND_TX 

P 

Ground (RF drivers) 

- 

32 

VPS_TX 

P 

Power supply (RF drivers) 

- 


1. I: Input, O: Output, and P: Power 

2. Must add a capacitor to ground (~1 nF). 

3. Pad internally connected to a Very Weak Pull-up to VPS. 

4. We recommend connecting this pin to the V PS pin using a 3.3 kOhm pull-up resistor. 

5. Pad internally connected to a Weak Pull-up to VPS. 

6. Must not be left floating. 

7. Pad internally connected to a Weak Pull-down to GND. 

8. Pad input in High Impedance. Must be connected to VPS. 
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Power management and operating modes 


3 Power management and operating modes 


3.1 Operating modes 

The CR95HF has 2 operating modes: Wait for Event (WFE) and Active. In Active mode, the 
CR95HF communicates actively with a tag or an external host (an MCU, for example). WFE 
mode includes four low consumption states: Power-up, Hibernate, Sleep and Tag Detector. 

The CR95HF can switch from one mode to another. 


Table 3. CR95HF operating modes and states 


Mode 

State 

Description 


Power-up 

This mode is accessible directly after POR. 

Low level on IRQJN pin (longer than 10 ps) is the only wakeup 
source. LFO (low-frequency oscillator) is running in this state. 


Hibernate 

Lowest power consumption state. The CR95HF has to be woken-up 
in order to communicate. Low level on IRQJN pin (longer than 10 
ps) is the only wakeup source. 

Wait For 

Event 

(WFE) 

Sleep 

Low power consumption state. Wakeup source is configurable: 

- Timer 

- IRQJN pin 

- SPIJ3S pin 

LFO (low-frequency oscillator) is running in this state. 


Tag Detector 

Low power consumption state with tag detection. Wakeup source is 
configurable: 

- Timer 

- IRQJN pin 

- SPIJ5S pin 

- Tag detector 

LFO (low-frequency oscillator) is running in this state. 

Active 

Ready 

In this mode, the RF is OFF and the CR95HF waits for a command 
(ProtocolSelect, ...) from the external host via the selected serial 
interface (UART or SPI). 

Reader 

The CR95HF can communicate with a tag using the selected 
protocol or with an external host using the selected serial interface 
(UART or SPI). 


Hibernate, Tag Detector, and Sleep states can only be activated by a command from the 
external host. As soon as any of these three states are activated, the CR95HF can no 
longer communicate with the external host. It can only be woken up. 


The behavior of the CR95HF in Tag Detector' state is defined by the Idle command. 
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CR95HF 


Figure 4. CR95HF initialization and operating state change 



3.2 Startup sequence 

Aft er the po wer supply is established at power-on, the CR95HF waits for a low pulse on the 
pin IRQJN (t-j) before automatically selecting the external interface (SPI or UART) and 
entering Ready state after a delay (t 3 ). 


Figure 5. Power-up sequence 
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1. Note for pin SSIO: — SPI selected,-UART selected 

2. Pin IRQJN low level < 0.2 VPSJVIain. 


Note: When CR95 HF leav es WFE mode (from Power-up, Ftibernate, Tag Detector, or Sleep) 

following an IRQJN/RX low level pulse, this pulse is NOT interpreted as the UART start bit 
character. 
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Power management and operating modes 


Note: 


Figure 5 shows the power-up sequence for a CR95HF device; where, 


ti 

4 2 


s the initial wake-up delay 
s the minimum interrupt width 
s the delay for the serial interface selection 
s the HFO setup time (t S u(HFO)) 
s the V PS ramp-up time from OV to V PS 


100 ps (minimum) 

10 ps (minimum) 

250 ns (typical) 

10 ms (maximum) 

10 ms (max. by design validation) 


VPS must be OV before executing the start-up segue nee. 

The serial interface is selected after the following falling edge of pin IRQ_IN when leaving 
from POR or Hibernate state. 


Table 4 lists the signal configuration used to select the serial communication interface. 


Table 4. Select serial communication interface selection table 



Pin 

Serial interface 

SSI_0 


UART: 0 

SPI: 1 

SSI_1 


UART: 0 

SPI: 0 
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CR95HF 


4 Communication protocols 


4.1 Universal asynchronous receiver/transmitter (UART) 

The host sends commands to the CR95HF and waits for replies. Polling for readiness is not 
necessary. The default baud rate is 57600 baud. The maximum allowed baud rate is 
2 Mbps. 


Figure 6. UART communication 


Sending commands to the CR95HF 



CMD 


LEN 
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DATA 


Receiving data from the CR95HF 

◄-► 

Several data bytes 



Resp Code 


LEN 


DATA 


DATA 




◄ - ► 

Several data bytes 


When sending commands, no data must be sent if the LEN field is zero. 

When receiving data from the CR95HF, no data will be received if the LEN field is zero. 
The formats of send and receive packets are identical. 

If an Echo command is sent, only one byte (0x55) is sent by the host. 

Figure 7 shows an example of an Echo command. 


Figure 7. Echo command and response example 



Caution: UART communication is LSB first. Stop bit duration is two Elementary Time Units 

(ETUs). 

Note: 1 When CR95HF leaves WFE mode (from Power-up, Hibernate, Sleep Detector or Tag 

Detector) following an IRQJN/RX low level pulse, this pulse is NOT interpreted as the UART 
start bit character. 

2 If the user loses UART synchronization, it can be recovered by sending an Echo command 
until a valid Echo reply is received. Otherwise, after a maximum of 528 Echo commands, 
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Communication protocols 


CR95HF will reply with an error code meaning its input buffer is full. The user can now 
restart a UART exchange. 


4.2 Serial peripheral interface (SPI) 

4.2.1 Polling mode 

In order to send commands and receive replies, the application software has to perform 3 
steps. 

1. Send the command to the CR95HF. 

2. Poll the CR95HF until it is ready to transmit the response. 

3. Read the response. 

The application software should never read data from the CR95HF without being sure that 
the CR95HF is ready to send the response. 

The maximum allowed SPI communication speed is f SCK . 

A Control byte is used to specify a communication type and direction: 

• 0x00: Send command to the CR95HF 

• 0x03: Poll the CR95HF 

• 0x02: Read data from the CR95HF 

• 0x01: Reset the CR95HF 

The SPISS line is used to select a device on the common SPI bus. The SPISS pin is 
active low. 

When the SPI_SS line is inactive, all data sent by the Master device is ignored and the 
MISO line remains in High Impedance state. 


Figure 8. Sending command to CR95HF 
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Figure 9. Polling the CR95HF until it is ready 
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1 " Flags are polled until data is ready (Bit 3 is set when data is ready) ” 
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Caution: 


Table 5. Interpretation of flags 


Bit 

Meaning (Application point of view) 

[7:4] 

Not significant 

3 

Data can be read from the CR95HF when set. 

2 

Data can be sent to the CR95HF when set. 

[1:0] 

Not significant 


Figure 10. Reading data from CR95HF 
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3 Several data bytes * 


Data must be sampled at the rising edge of the SCK signal. 


‘Sending ’, ‘Polling’ and ‘Reading’ commands must be separated by a high level of the 
SPISS lin e. For ex ample, when the application needs to wait for data fro m the CR 95HF, it 
asserts the SPI SS line low and issues a ‘Polling’ command. Keeping the SPI SS line low, 
the Host can read the Flags Wait ing bit w hich indicates that the CR95HF can be read. Then, 
the applicat ion has to assert the SPI_SS line high to finish the polling command. The Host 
asserts the SPI_SS line low and issues a ‘Reading’ command to read data. When all data is 
read, the application asserts the SPI_SS line high. 

The application is not obliged to keep reading Flags using the Polling command until the 
CR95HF is ready in one command. I t can iss ue as many 'Polling' commands as necessary. 
For example, the application asserts SPI_SS low, issues 'Pol ling' com mands and reads 
Flags. If the CR95HF is not ready, the application can assert SPI_SS high and continue its 
algorithm (measuring temperat ure, communication with something else). Then, the 
application can assert SPI_SS low again and again issue 'Polling' commands, and so on, as 
many times as necessary, until the CR95HF is ready. 

Note that at the beginning of communication, the application does not need to check flags to 
start transmission. The CR95HF is assumed to be ready to receive a command from the 
application. 


Figure 11. Reset the CR95HF 
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To reset the CR95HF using the SPI, the application sends the SPI Reset command (Control 
Byte 01, see Figure 11) which starts the internal controller reset pr ocess an d puts the 
CR95HF into Power-up state. The CR95HF will wake up when pin IRQJN goes low. The 
CR95HF reset process only starts when the SPI_SS pin returns to high level. 

SPI communication is MSB first. 
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4.2.2 Interrupt mode 

When the CR95HF is configure to use the SPI serial interface, pin IRQ_OUT is used to give 
additional information to user. When the CR95 HF is read y to send back a reply, it sends an 
Interrupt Request by setting a low level on pin IRQ_OUT, which remains low until the host 
reads the data. 

The application can use the Interrupt mode to skip the polling stage. 

Caution: SPI communication is MSB first. 

4.3 Error codes 

Table 6. Possible error codes and their meaning 


Code 

Name 

Meaning 

0X63 

EEmdSOFerror23 

SOF error in high part (duration 2 to 3 etu) in ISO/IEC 14443B 

0x65 

EEmdSOFerrorlO 

SOF error in low part (duration 10 to 11 etu) in ISO/IEC 14443B 

0x66 

EEmdEgt error 

Extennded Guard Time error in ISO/IEC 14443B 

0x67 

ETrl Too Big Too long 

TR1 send by the card, reception stopped in ISO/IEC 14443BT 

0x68 

ETrlToo small Too 
small 

TR1 send by the card in ISO/IEC 14443B 

0x71 

EinternalError 

Wrong frame format decodes 

0x80 

EFrameRecvOK 

Frame correctly received (additionally see CRC/Parity 
information) 

0x85 

EUserStop 

Stopped by user (used only in Card mode) 

0x86 

ECommError 

Hardware communication error 

0x87 

EFrameWaitTOut 

Frame wait time out (no valid reception) 

0x88 

ElnvalidSof 

Invalid SOF 

0x89 

EBufOverflow 

Too many bytes received and data still arriving 

0x8A 

EFramingError 

if start bit = 1 or stop bit = 0 

0x8B 

EEgtError 

EGT time out 

0x8C 

ElnvalidLen 

Valid for ISO/IEC 18092, if Length <3 

0x8D 

ECrcError 

CRC error, Valid only for ISO/IEC 18092 

0x8E 

ERecvLost 

When reception is lost without EOF received (or subcarrier was 
lost) 

0x8F 

ENoField 

When Listen command detects the absence of external field 

0x90 

EUnintByte 

Residual bits in last byte. Useful for ACK/NAK reception of 
ISO/IEC 14443 Type A. 
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4.4 Support of long frames 

In Reader mode it is possible to receive up to 528 bytes of frame data from VICC and Type- 
13 cards and up to 256 bytes of frame data from Type-A cards. In this case, the device sends 
a reply to the external MCU in the following format: 

<ResultCode> + <Len> + <N bytes of data> 


Table 7. Format of ResultCode 


Bit 

Meaning 

7 

Always 1 

6 

Bit 9 of Length 

See examples and explanation below 

5 

Bit 8 of Length 

4 

If set, there are residual bits in the last byte. Applicable only for Type-A protocol. 

3:0 

Always 0 


Figure 12. Long frame format 



The number of databytes is 10-bit long. 


Table 8. Examples of ResultCode: Len pairs 


ResultCode 

Len 

Length of data 

0x80 

0x00 

0 

0x80 

0x01 

1 

0x80 

OxFF 

255 

OxAO 

0x00 

256 

OxAO 

0x01 

257 

OxAO 

OxFF 

511 

OxCO 

0x00 

512 

OxCO 

0x01 

513 
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5 Commands 

5.1 Command format 

• The frame from the Host to the CR95HF has the following format: 

<CMDxLenxData> 

• The frame from the CR95HF to Host has the following format: 

<RespCodexLenxData> 

These two formats are available either in both UART and SPI modes. 

Fields <Cmd>, <RespCode> and <Len> are always 1 byte long. <Data> can be from 0 to 
253 bytes. 

Note: The Echo command is an exception as it has only one byte (0x55). 

The following symbols correspond to: 

»> Frame sent by the Host to CR95HF 
«< Frame sent by the CR95HF to the Host 


5.2 List of commands 


Table 9 summarizes the available commands. 

Table 9. List of CR95HF commands 


Code 

Command 

Description 

0x01 

IDN 

Requests short information about the CR95HF and its revision. 

0x02 

ProtocolSelect 

Selects the RF communication protocol and specifies certain 
protocol-related parameters. 

0x04 

SendRecv 

Sends data using the previously selected protocol and receives the 
tag response. 

0x07 

Idle 

Switches the CR95HF into a low consumption Wait for Event 
(WFE) mode (Power-up, Hibernate, Sleep or Tag Detection), 
specifies the authorized wake-up sources and waits for an event to 
exit to Ready state. 

0x08 

RdReg 

Reads Wake-up event register or the Analog Register 

Configuration (ARC_B) register. 

0x09 

WrReg 

Writes Analog Register Configuration (ARC_B)) register or writes 
index of ARC_B register address. 

Writes the Timer Window (TimerW) value dedicated to ISO/I EC 
14443 Type A tags. 

Writes the AutoDetect Filter enable register dedicated to ISO/IEC 
18092 tags. 

OxOA 

Baud Rate 

Sets the UART baud rate. 

0x55 

Echo 

CR95HF returns an Echo response (0x55). 

Other codes 

ST Reserved 
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5.3 IDN command (0x01) description 


The IDN command (0x01) gives brief information about the CR95HF and its revision. 

Table 10. IDN command description 


Direction 

Data 

Comments 

Example 

Host to 
CR95HF 

0x01 

Command code 

>»0x0100 

0x00 

Length of data 

CR95HF to 
Host 

0x00 

Result code 

«<0x000F4E4643204653324A415354 

34002ACE 

In this example, 

<«0x4E4 6432 04 65332 4A41535434 00 

: ‘NFC FS2JAST4’, #4 (Last Character of 
NFC FS2JAST4 means ROM code 
revision 4.) 

0x2ace: CRC of ROM (real CRC may 
differ from this example) 

<Len> 

Length of data 

<Device ID> 

Data in ASCII format (13 
bytes) 

<ROM CRC> 

CRC calculated for ROM 
content (2 bytes) 


It takes approximately 6 ms to calculate the CRC for the entire ROM. The application must 
allow sufficient time for waiting for a response for this command. 


5.4 Protocol Select command (0x02) description 

This command selects the RF communication protocol and prepares the CR95HF for 
communication with a contactless tag. 


Table 11. ProtocolSelect command description 


Direction 

Data 

Comments 

Example 


0x02 

Command code 



<Len> 

Length of data 


Host to 
CR95HF 

<Protocol> 

Protocol codes: 

00: Field OFF 

01: ISO/IEC 15693 

02: ISO/IEC 14443-A 

03: ISO/IEC 14443-B 

04: ISO/IEC 18092 /NFC 
Forum Tag Type 3 

See Table 12: List of <Parameters> 
values for the ProtocolSelect command 
for different protocols on page 21 for a 
detailed example. 


<Parameters> 

Each protocol has a 
different set of 
parameters. See 

Table 12. 


CR95HF to 

0x00 

Result code 

<«0x0000 

Host 

0x00 

Length of data 

Protocol is successfully selected 

CR95HF to 

0x82 

Error code 

<<<0x8200 

Host 

0x00 

Length of data 

Invalid command length 
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Table 11. ProtocolSelect command description (continued) 


Direction 

Data 

Comments 

Example 

CR95HF to 
Host 

0x83 

Error code 

<<<0x8300 

Invalid protocol 

0x00 

Length of data 


Note that there is no ‘Field ON' command. When the application selects an RF 
communication protocol, the field automatically switches ON . 

When the application selects a protocol, the CR95HF performs all necessary settings: it will 
choose the appropriate reception and transmission chains, switch ON or OFF the RF field 
and connect the antenna accordingly. 

Different protocols have different sets of parameters. Values for the <Parameters> field 
are listed in Table 12. 


Table 12. List of <Parameters> values for the ProtocolSelect command for different 

protocols 


Protocol 

Code 

Parameters 

Examples of commands 

Byte 

Bit 

Function 




Field OFF 

0x00 

0 

7:0 

RFU 

>>>0x02020000 




7:6 

RFU 





5:4 

00: 26 Kbps (H) 

01: 52 Kbps 

10: 6 Kbps (L) 

11: RFU 

H 100 S: >»0x02 02 01 01 

H 100 D: >»0x02 02 01 03 

H 10 S: >>>0x02 02 01 05 

H 10 D: >>>0x02 02 01 07 




3 

0: Respect 312-ps delay 

L 100 S: >»0x02 02 01 21 

ISO/IEC 15693 

0x01 

0 


l: Wait for SOF W 

L 100 D: >»0x02 02 01 23 





0: 100% modulation (100) 

L 10 S: >>>0x02 02 01 25 




z 

l: 10% modulation (10) 

L 10 D: >>>0x02 02 01 27 




i 

0: Single subcarrier (S) 
l: Dual subcarrier (D) 

In these examples, the CRC is 
automatically appended. 




0 

Append CRC if set to ‘1’. 

(i) 
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Table 12. List of <Parameters> values for the ProtocolSelect command for different 

protocols (continued) 


Protocol 

Code 

Parameters 

Examples of commands 

Byte 

Bit 

Function 

ISO/I EC 14443 
Type A 

NFC Forum Tag 
Type 1 
(Topaz) 



7:6 

Transmission data rate 

00: 106 Kbps 

01: 212 Kbps (2) 

10: 424 Kbps 

11: RFU 

>>>0x02020200: ISO/IEC 
14443 Type A tag, 106 Kbps 
transmission and reception 
rates, Time interval 86/90 

Note that RECA, WUPA, 
Select20 and Select70 
commands use a fixed interval 
of 86/90 ps between a request 
and its reply. Other commands 
use a variable interval with 
fixed granularity. 

Refer to the ISO/IEC 14443 


0 

5:4 

Reception data rate 

00: 106 Kbps 

01: 212 Kbps 

10: 424 Kbps 

11: RFU 

0x02 


3 

RFU 

NFC Forum Tag 
Type 2 



2:0 

RFU 

standard for more details. 


1 

7:0 

PP 

These 5 bytes are optional. The 
default PP:MM:DD value is 0 
(corresponds to FDT 86/90ps). 

NFC Forum Tag 


2 

7:0 

MM 

Type 4A 


3 

7:0 

DD (optional to PP:MM) 

For other values, FDT = 
(2 A PP)*(MM+1 )*(DD+128) 
*32/13.56 ps 



4 

7:0 

ST Reserved (Optional) 




5 

7:0 

ST Reserved (Optional) 
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Table 12. List of <Parameters> values for the ProtocolSelect command for different 

protocols (continued) 


Protocol 

Code 

Parameters 

Examples of commands 

Byte 

Bit 

Function 




7:6 

Transmission data rate 

00: 106 Kbps 

01: 212 Kbps 

10: 424 Kbps 

11: 848 Kbps 




0 

5:4 

Reception data rate 

00: 106 Kbps 

01: 212 Kbps 

10: 424 Kbps 

11: 848 Kbps 

>>>0x02020301: 

ISO/I EC 14443 Type B tag with 
CRC appended 




3:1 

RFU 


ISO/I EC 14443 
Type B 



0 

Append CRC if set to T. 

(i) 


0x03 

1 

7:0 

PP 

These 9 bytes are optional. 
Default value of PP:MM:DD is 0 
and corresponds to FWT 

NFC Forum Tag 


2 

7:0 

MM 

Type 4B 


3 

7:0 

DD (optional to PP:MM) 

~302ps. 

FWT = 

(2 A PP)*(MM+1 )*(DD+128)* 
32/13.56 ps 



5:4 

7:0 

TTTT (Optional) 

TR0 = TTTT/FC (LSB first), 
default 1023 = 0x3FF 



6 

7:0 

YY (Optional) 

PCD Min TR1 (Min TR1 = 8 * 
XX / f s ), default = 0 



7 

7:0 

ZZ (Optional) 

PCD Max TR1 (Max_TR1 = 8 * 
ZZ/f s ), default = 26 = 0x1 A 



8 

7:0 

ST Reserved (Optional) 




9 

7:0 

ST Reserved (Optional) 
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Table 12. List of <Parameters> values for the ProtocolSelect command for different 

protocols (continued) 


Protocol 

Code 

Parameters 

Examples of commands 

Byte 

Bit 

Function 





Transmission data rate 





7:6 

00: RFU 

01: 212 Kbps 

10: 424 Kbps 

11: RFU 

>>>0x02020451: 

ISO/IEC18092 tag, 212 Kbps 
transmission and reception 
rates with CRC appended. 



0 

5:4 

Reception data rate 

00: RFU 

01: 212 Kbps 

10: 424 Kbps 

11: RFU 

Parameter ‘Slot counter’ is not 
mandatory. If it is not present, it 
is assumed that SlotCounter = 
0x00 (1 slot) 




3:1 

RFU 

For device detection 

ISO/IEC 18092 



0 

Append CRC if set to T. 

(i) 

commands, byte 1 bit 4 must 
be set to ‘O’. In this case, the 
FWT is 2.4 ms for the 1st slot 
and 1.2 ms more for each 

NFC Forum Tag 
Type 3 

0x04 


7:5 

RFU 



4 

0: FWT = 2.4 ms 

1: FWT is specified by 
PP:MM bits 

following slot, if slot counter is 
specified. 

If slot counter = 0x10, the 
CR95HF does not respect reply 
timings, but polls incoming data 
and searches a valid response 
during ~8.4 ms. 



1 

3:0 

Slot counter 

0: 1 slot 

1: 2 slots 





f: 16 slots 




2 

7:0 

PP 

These 3 bytes are optional. 
Default value PP:MM:DD: is 0 
and corresponds to RWT 



3 

7:0 

MM 



4 

7:0 

DD (optional to PP:MM) 

~302ps. 

RWT = (2 A PP)*(MM+1 )* 
(DD+128)*32/13.56ps 


1. It is recommended to set this bit to ‘ 1 ’. 

2. Not characterized. 
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5.5 Send Receive (SendRecv) command (0x04) description 

This command sends data to a contactless tag and receives its reply. 

Before sending this command, the Host must first send the ProtocolSelect command to 
select an RF communication protocol. 

If the tag response was received and decoded correctly, the <Data> field can contain 
additional information which is protocol-specific. This is explained in Table 14. 


Table 13. SendRecv command description 


Direction 

Data 

Comments 

Example 

Host to 
CR95HF 

0x04 

Command code 

See Table 14 and Table 18 for detailed 
examples. 

<Len> 

Length of data 


<Data> 

Data to be sent 


0x80 

Result code 

<«0x800F507 7FE01B3 0000000000 

CR95HF to 

<Len> 

Length of data 

71718EBA00 

Host 

<Data> 

Data received. 
Interpretation depends on 
protocol 

The tag response is decoded. This is an 
example of an ISO/I EC 14443 ATQB 
response (Answer to Request Type B) 


0x90 

Result code 

<<<0x90040x240000 (exception for 
4-bit frames where ‘x’ represents ACK 
or NAK value) 


<Len> 

Length of data 

CR95HF to 
Host 

ACK Or NAK 

ISO 14443-A 

ACK or NAK detection 

90: Result code for “non-integer 
number of bytes are received” 

04: total length of data 

0A or 00: Data 

2 4: “2” means no CRC, “4” means 4 
significant bits in Data byte. 

00 00: No collision in response 

Example ACK 

<« 0x90040A240000 

Example NAK 

<« 0x900400240000 


xx yy zz 

3-byte response flag 
analysis 

xx: Error type and number of significant 
bits in first data byte 
yy: First byte collision 
zz: First bit collision ^ 

CR95HF to 
Host 

X0 + <Len> + Data (See Support of long frames on page 18) 

CR95HF to 

0x86 

Error code 

<<<0x8600 Communication error 

Host 

0x00 

Length of data 

CR95HF to 

0x87 

Error code 

<<<0x8700 Frame wait time out or no 

Host 

0x00 

Length of data 

tag 
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Table 13. SendRecv command description (continued) 


Direction 

Data 

Comments 

Example 

CR95HF to 
Host 

0x88 

Error code 

<<<0x8800 Invalid SOF 

0x00 

Length of data 

CR95HF to 
Host 

0x89 

Error code 

<<<0x8900 Receive buffer overflow 
(too many bytes received) 

0x00 

Length of data 

CR95HF to 
Host 

0x8A 

Error code 

<«0x8A00 Framing error (start bit = 0, 
stop bit = 1) 

0x00 

Length of data 

CR95HF to 
Host 

0x8B 

Error code 

<«0x8B00 EGT time out (for ISO/IEC 
14443-B) 

0x00 

Length of data 

CR95HF to 
Host 

0x8C 

Error code 

<«0x8C00 Invalid length. Used in NFC 
Forum Tag Type 3, when field Length < 

3 

0x00 

Length of data 

CR95HF to 
Host 

0x8D 

Error code 

<«0x8D00 CRC error (Used in NFC 
Forum Tag Type 3 protocol) 

0x00 

Length of data 

CR95HF to 
Host 

0x8E 

Error code 

<«0x8E00 Reception lost without EOF 
received 

0x00 

Length of data 


1. See Table 14 for details. 


Table 14 gives examples of communication between the CR95HF and a contactless tag. 
The CR95HF receives a SendRecv command (»> 0x04...) from the host and returns its 
response to the host («< 0x80...). Table 14 provides more details on the CR95HF 
response format. 


Table 14. List of <Data> Send values for the SendRecv command for different 

protocols 


Protocol 


Explanation 


Send example 
Command code 


04 


Command example 


Comments 


03 


022000 


Example of an Inventory command 
using different protocol configuration: 
Uplink: 100% ASK, 1/4 coding 


ISO/IEC 

15693 


Length of entire data field 


Downlink: High data rate, Single sub¬ 
carrier 

»> 0x0403260100 (Inventory -1 slot) 


Data 


«< 0x800D0000CDE0406CD62 902 
E0057900 


If length of data is ‘O’, only the EOF will 
be sent. This can be used for an anti¬ 
collision procedure. 
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Table 14. List of <Data> Send values for the SendRecv command for different 

protocols (continued) 


Protocol 


Explanation 


Command example 


Comments 


Send example 


04 


07 


9370800 

F8C8E 


Command code 

Length of entire data field 

Data 


Example of an NFC Forum Type 2 
request sequence: 

>>>0x04022607 (REQA) 
<<<0x800544002800 (ATQA) 
>>>0x0403932008 (Anti-collision CL1) 
<«0x80088804A8D5F1280000 (UID 


CL1)... 


ISO/IEC 
14443 
Type A 


NFC 

Forum Tag 
Type 4A 

NFC 

Forum Tag 
Type 1 
(Topaz) 

NFC 

Forum Tag 
Type 2 


Transmission flags: 

7: Topaz send format. Use EOF instead of 
parity bit and use SOF at beginning of each 
byte. Pause between bytes and assume 1st 
byte is 7 bits. 

6: SplitFrame 
5: Append CRC 
4: Parity Framing mode ® 

[3:0]: Number of significant bits in last byte 


Example of an NFC Forum Type 1 
(Topaz) request sequence: 
>>>0x04022607 (REQA) 
<«0x8005000c280000 (ATQ0 ATQ1) 
>»0x040878000000000000A8 (RID) 
<«Ox800B114 86E567A003E450800 
00 (HeaderO Headerl UID0 UID 1 UID2 
UID3 CRC0 CRCISignifcant bits 
indexColbyte IndexColbit) 

Application SW must specify how many 
bits to send in the last byte. If flag 
SplitFrame is set, CR95HF will expect 
8 - significant bit count> bits in the 1 st 
byte during reception. 

In this case, the first byte received is 
padded with zeros in Isb to complete the 
byte, while the last byte received is 
padded with zeros in msb. 

Example of an anti-collision command 
/response in ISO/IEC 14443_A 
communication using a Split frame: C) 

»> 0x0403932008 (Anticol) 

«< 0x800888047B7 5B7B802 04 
(Collision Detected B8) 

»> 0x0406934588040B45 (Anticol 
Split frame request 45) 

«< 0x80064074B3230000 (Spilt 
frame Answer 23) 


ISO/IEC 
14443 
Type B 


Send example 


04 


03 


050000 


Command code 


This command is useful for anti-collision. 


Example of an NFC Forum Type 4B 
request sequence: 


Length of entire data field 

NFC 

Forum Tag Data 
Type 4B 


>>>0x0403050000 (REQB) 
<«0x800F5077FE01B3 0000000000 
71718EBA00 (ATQB) 
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Table 14. List of <Data> Send values for the SendRecv command for different 


protocols (continued) 


Protocol 

Explanation 

Command example 

Comments 

ISO/IEC 

18092 

Send example 

Command code 

04 

05 

00FFFF0000 

Example of an ISO/IEC 18092 / NFC 
Forum Type 3 request sequence: 

NFC 

Forum Tag 
Type 3 

Length of entire data field 

Data 


»>0x040500FFFF0000 (REQC) 

«<0x801201010102148E0DB41310 

0B4B42 84 85D0FF0 0 (ATQC) 


1. For more information on using split frames, refer to Appendix D on page 58. 


2. If Parity Framing mode is used (Bit 4 of transmission flag byte is set to T), then the parity bit must be 
coded inside the data for each byte to be sent using the send/receive command in Transmit mode, and is 
not decoded by the CR95FIF in Receive mode. In Receive mode, each data byte is accompanied by an 
additional byte which encodes the parity: <data byte> <parity byte> <data byte > ... 

Examples of data received by send / receive in Parity Framing mode: 

80 05 32 80 34 00 00 

meaning: if the CR95FIF received 2 data bytes: 

0x32 with parity = T (0x80) and 0x34 with parity = ‘O' (0x0) in Parity Framing mode. For more details, 
see NFC Forum Tag Type 2 on page 64. 

The Parity Framing mode is compatible with MIFARE® Classic requirements. Plowever, access to 
Authenticated state must be supported by the external secure host which embeds the MIFARE® Classic 
library. 


Figure 13. Data transfer (in both command and response) when Parity Framing mode 

is enabled 


Bytes 
sent or 
received 


xxxxxxxx 

•+ -► 

Data Byte 


P0000000 

-► 

Parity Byte 


2nd CRC 

2nd CRC Byte 


P0000000 

-► 

Parity Byte 


Table 15. List of <Data> Response values for the SendRecv command for different 

protocols 


Protocol 


Explanation 


Response example 


Comments 


ISO/IEC 

15693 


Response 

example 


80 


Result code 


08 


Length of entire data 
field 


0000000000 


Data received from tag 


77CF 


Original (received) value of CRC 


[7:2]: RFU 

1: CRC error if set 

0: Collision is detected if set 


00 


This is a response to Read 
Single Block command for 
ISO/IEC 15693 TAG. Actual 
TAG response is 
«<0x000000000077CF, 
other fields are added by the 
CR95HF. 
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Table 15. List of <Data> Response values for the SendRecv command for different 

protocols (continued) 


Protocol 

Explanation 

Response example 

Comments 

ISO/IEC 

14443 

Type A 

Response 

example 

80 

or 

90 

(1) 

09 

80B30B8DB500 

00 

00 

00 

ISO/IEC 14443-A is bit 
oriented protocol, so we can 
receive non-integer amount 
of bytes. Number of 
significant bits in the 1 st byte 
is the same as indicated in 

Result code 








NFC 

Forum Tag 
Type 4A 

Length of entire data 
field 






the command sent. 

Data received from TAG 





To calculate a position of a 
collision, application has to 
take index of byte first. 

Index of bit indicates a 
position inside this byte. 

Note that both indexes start 
from 0 and bit index can be 

8, meaning that collision 
affected parity. 

NFC 

Forum Tag 
Type 1 
(Topaz) 

7: Collision is detected 

6: RFU 

5: CRC error 

4: Parity error 

[3:0]: Shows how many significant bits are there 
in the first byte 



NFC 

Forum Tag 
Type 2 

7:0: Index of the first byte where collision is detected 


[7:4]: RFU 

[3:0]: Index of the first bit where collision is detected 


Note that collision 
information is only valid 
when bit ‘Collision is 
detected’ is set. ^ 


Response 

example 

80 

OF 

5092036A8D0 

00000000071 

71 


3411 

00 


ISO/IEC 

14443 

Type B 

Result code 









Length of entire data 
field 







NFC 

Data received from tag 







Forum Tag 
Type 4B 

Original (received) value of CRC 






[7:2]: RFU 

1: CRC error if set 

0: RFU 









Response 

example 

80 

12 

01010105017B0. 

. . 93FF 

00 


ISO/IEC 

Result code 









18092 

NFC 

Forum Tag 

Length of entire data 
field 






<<<0x801201010105017 

B06941004014B024F499 

Data received from tag 






3FF00 

Type 3 

[7:2]: RFU 

1: CRC error if set 

0: RFU 









1. Result code 90: Response is decoded but number of byte is not an integer. 


2. For more information on using split frames, refer to Appendix D on page 58. 
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5.6 


For more detailed examples of use with NFC Forum and ISO/IEC 15693 tags, refer to 
Appendix D on page 58. 

If Parity Framing mode is used, the parity bit stays unchanged. On transmission, it is not 
encoded and on reception it is not decoded. The length of Data must be even. Each data 
byte is accompanied by an additional byte which encodes the parity: 

<DataByte>, <Parity>, <DataByte>, <Parity> ... 


Table 16. Structure of Parity byte 


Bit 

Description 

7 

Parity bit 

[6:0] 

Reserved for future use 


On reception, bits [6:0] of the parity byte are zeroes; on transmission, bits [6:0] are ignored. 


Idle command (0x07) description 

This command switches the CR95HF into low consumption mode and defines the way to 
return to Ready state. 

The Result code contains the Wake-up flag register value indicating to the application the 
wake-up event that caused the device to exit WFE mode. 
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Table 17. Idle command description 


Direction 


Data 

Comments 

07 

Command code 

0E 

Length of data 

<WU Source> 

Specifies authorized wake- 
up sources and the LFO 
frequency 

EnterCtrlL 

Settings to enter WFE 
mode 

EnterCtrlH 

WUCtrlL 

Settings to wake-up from 
WFE mode 

WUCtrlH 

LeaveCtrlL 

Settings to leave WFE 
mode (Default value = 
0x1800) 

LeaveCtrlH 

<WUPeriod> 

Period of time between two 
tag detection bursts. Also 
used to specify the duration 
before Timeout. 

<OscStart> 

Defines the Wait time for 
HFO to stabilize: 

<OscStart> * tL 

(Default value = 0x60) 

<DacStart> 

Defines the Wait time for 
DAC to stabilize: 

<DacStart> * tL 

(Default value = 0x60) 

<DacDataL> 

Lower compare value for 
tag detection 

This value must be set to 
0x00 during tag detection 
calibration. 

<DacDataH> 

Higher compare value for 
tag detection 

This is a variable used 
during tag detection 
calibration. 

<SwingsCnt> 

Number of swings HF 
during tag detection 
(Default value = 0x3F) 

<MaxSleep> 

Max. number of tag 
detection trials before 
Timeout 

This value must be set to 
0x01 during tag detection 
calibration. 

Also used to specify 
duration before Timeout. 

MaxSIeep must be: 

0x00 < MaxSIeep < 0x1 F 


Example 


Host to 
CR95HF 


Example of switch from Active 
mode to Hibernate state: 

»>0x07 OE 08 04 00 04 00 
18 00 00 00 00 00 00 00 00 

Example of switch from Active to 
W FE mode (wake-up by low pulse 
on IRQJN pin): 

»>0x07 0E 08 01 00 38 00 
18 00 00 60 00 00 00 00 00 

Example of switch from Active to 
W FE mode (wake-up by low pulse 
on SPI_SS pin): 

»>0x07 0E 10 01 00 38 00 
18 00 00 60 00 00 00 00 00 

Example of wake-up by Timeout (7 
seconds): 

Duration before Timeout = 256 * t L 
* (WU period + 2) * (MaxSIeep + 1) 

»>0x07 0E 01 21 00 38 00 
18 00 60 60 00 00 00 00 08 

Example of switch from Active to 
Tag Detector mode (wake-up by 
tag detection or low pulse on 


IFtQJN pin) (32 kHz, inactivity 
duration = 272 ms, DAC oscillator 
= 3 ms, Swing = 63 pulses of 13.56 
MHz): 

»>0x07 0E 0A 21 00 79 01 
18 00 20 60 60 64 74 3F 08 

Example of a basic Idle command 
used during the Tag Detection 
Calibration process: 

»>0x07 0E 03 A1 00 F8 01 
18 00 20 60 60 00 xx 3F 01 

where xx is the DacDataH value. 
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Table 17. Idle command description (continued) 


Direction 

Data 

Comments 

Example 

CR95HF to 
Host 

0x00 

Result code 

This response is sent only when 
CR95HF exits WFE mode. 

<<<0x000101 Wake-up by 
Timeout 

<<<0x000102 Wake-up by tag 
detect 

<<<0x000108 Wake-up by low 
pulse on IRQJN pin 

0x01 

Length of data 

<Data> 

Data (Wake-up source): 
0x01: Timeout 

0x02: Tag detect 

0x08: Low pulse on 

IRQJN pin 

0x10: Low pulse on 
SPI_SS pin 

CR95HF to 
Host 

0x82 

Error code 

<<<0x82 00 Invalid command 
length 

0x00 

Length of data 


1. An initial calibration is necessary to determine DacDataL and DacDataH values required for leaving Tag 
Detector state. For more information, contact your ST sales office for the corresponding application note. 


5.6.1 Idle command parameters 

The Idle command (Host to CR95HF) has the following structure (all values are 
hexadecimal): 


Table 18. Idle command structure 


07 

0E 

XX 

yy zz 

yy zz 

yy zz 

aa 

bb 

cc 

dd ee 

ff 

gg 

Comma 
nd code 

Data 

length 

WU 

source 

Enter 

Control 

WU 

Control 

Leave 

Control 

WU 

Period 

Osc 

Start 

DAC 

Start 

DAC 

Data 

Swing 

Count 

Max 

Sleep 


Table 19. Summary of Idle command parameters 


Parameter 

Description 

Command code 

This byte is the command code. ‘07’ represents the Idle command. This 
command switches the device from Active mode to WFE mode. 

Data length 

This byte is the length of the command in bytes. Its value depends on the 
following parameter values. 

WU Source 

This byte defines the authorized wake-up sources in the Wake-up source 
register. Predefined values are: 

0x01: Time out 0x02: Tag Detection 

0x08: Low pulse on IRQJN 0x10: Low pulse on SPIJ3S 

Enter Control 

These two bytes (EnterCtrIL and EnterCtrIH) define the resources when 
entering WFE mode. 

0x04 00: Hibernate 

0x0100: Sleep (or 0x2100 if Timer source is enabled) 

OxAlOO: Tag Detector Calibration 

0x2100: Tag Detection 

WU Control 

These two bytes (WuCtrIL and WuCtrIH) define the wake-up resources. 
0x0400: Hibernate 0x3800: Sleep 

0xF80l: Tag Detector Calibration 0x7901: Tag Detection 
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Table 19. Summary of Idle command parameters (continued) 


Parameter 

Description 

Leave Control 

These two bytes (LeaveCtrIL and LeaveCtrIH) define the resources when 
returning to Ready state. 

0x1800: Hibernate 0x1800: Sleep 

0x1800: Tag Detector Calibration 0x1800: Tag Detection 

WU Period 

This byte is the coefficient used to adjust the time allowed between two tag 
detections. Also used to specify the duration before Timeout. (Typical 
value: 0x20) 

Duration before Timeout = 256 * t L * (WU period + 2) * (MaxSIeep + 1) 

Osc Start 

This byte defines the delay for HFO stabilization. (Recommended value: 
0x60) 

Defines the Wait time for HFO to stabilize: <OscStart> * tL 

DAC Start 

This byte defines the delay for DAC stabilization. (Recommended value: 
0x60) 

Defines the Wait time for DAC to stabilize: <DacStart> * tL 

DAC Data 

These two bytes (DacDataL and DacDataH) define the lower and higher 
comparator values, respectively. These values are determined by a 
calibration process. 

When using the demo board, these values should be set to approximately 
0x64 and 0x74, respectively. 

Swing Count 

This byte defines the number of HF swings allowed during Tag Detection. 
(Recommended value: 0x3F) 

Max Sleep 

This byte defines the maximum number of tag detection trials or the 
coefficient to adjust the maximum inactivity duration before Timeout. 
MaxSIeep must be: 0x00 < MaxSIeep < 0x1 F 

This value must be set to 0x01 during tag detection calibration. 

Also used to specify duration before Timeout. 

Duration before Timeout = 256 * t L * (WU period + 2) * (MaxSIeep + 1) 
(Typical value: 0x28) 


5.6.2 Using LFO frequency setting to reduce power consumption 

In WFE mode, the high frequency oscillator (HFO) is stopped and most processes being 
executed are clocked by the low frequency oscillator (LFO). To minimize CR95HF power 
consumption in WFE mode, the slower the LFO frequency, the lower the power 
consumption. 

Example 1: Setting a lower LFO frequency 
The following equation defines a basic timing reference: 
t REF = 256*t L ms (where t L = 1/f|_Fo) 
t REF = 8 ms (when bits [7:6] are set to “00”, or 32 kHz) 
t REF = 64 ms (when bits [7:6] are set to “11”, or 4 kHz) 



DoclD018669 Rev 12 


33/77 













Commands 


CR95HF 


5.6.3 Optimizing wake-up conditions 

Using the Wake-up source register, it is possible to cumulate sources for a wake-up event. It 
is strongly recommended to always set an external event as a possible wake-up source. 

To cumulate wake-up sources, simply set the corresponding bits in the Wake-up source 
register. For exa mple, to enable a wake-up when a tag is detected (bit 1 set to ‘1’) or on a 
low pulse on pin IRQJN (bit 3 set to T), set the register to OxOA. 

5.6.4 Using various techniques to return to Ready state 

The Idle command and reply set offers several benefits to users by enabling various 
methods to return the CR95HF to Ready state. Some methods are nearly automatic, such 
as waiting for a timer overflow or a tag detection, but others consume more power compared 
to the ones requesting a host action. A description of each method follows below. 

Default setting: from POR to Ready state 

After power-on, the CR95HF enters Power-up state. 

To wake up the CR95HF and set it to Ready state, the user must send a low pulse on the 
IRQJN pin. The CR95HF then automatically selects the external interface (SPI or UART) 
and enters Ready state and is able to accept commSands after a delay of approximately 
6 ms (t 3 ). 

From Ready state to Hibernate state and back to Ready state 

In Hibernate state, most resources are switched off to achieve an ultra-low power 
consumption. 

The only wa y the CR 95HF can wake-up from Hibernate state is by an external event (low 
pulse on pin IRQJN). 

A basic Idle command is: 

>>>0x07 0E 08 04 00 04 00 18 00 00 00 00 00 00 00 00 

Note: The Wake-up flag value is NOT significant when returning to Ready state from Hibernate 

state or after a POR. 

From Ready state to Sleep state and back to Ready state 

Wake-up by external event (low pulse on IRQJN or SPI SS pin) 

In Sleep or Power-up states, operating resources are limited in function of the selected 
wake-up source to achieve a moderate power consumption level. 

An Idle command example when wake-up source is pin IRQJN: 

>>>0x07 0E 08 01 00 38 00 18 00 00 60 00 00 00 00 00 
A similar command can be implemented using pin SPI_SS as a wake-up source: 

>>>0x07 0E 10 01 00 38 00 18 00 00 60 00 00 00 00 00 

Wake-up by timeout 

The LFO is required to use the timer. However, this increases the typical power 
consumption by 80 pA. Several parameters can be modified to reduce power consumption 
as much as possible. 
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The Duration before Timeout is defined by parameters WU period and MaxSIeep, 
respectively 0x60 and 0x08 in the following example. 

Duration before Timeout = 256 * t L * (WU period + 2) * (MaxSIeep + 1) 

Note: Note that: 0x00 < MaxSIeep < 0x1 F. 

An Idle command example when wake-up source is timer (0x01) when f LFO = 32 kHz (mean 
power consumption is 25 pA) 

>>>0x07 0E 01 21 00 38 00 18 00 60 60 00 00 00 00 08 

An Idle command example when wake-up source is timer (OxCl) when f LF0 = 4 kHz (mean 
power consumption is 20 pA): 

>>>0x07 0E Cl 21 00 38 00 18 00 60 60 00 00 00 00 08 

The same command can be used mixing a timer and the IRQ_IN pin (0xC9) as a wake-up 
source: 

>>>0x07 0E C9 21 00 38 00 18 00 60 60 00 00 00 00 08 

Wake-up by Tag Detection 

In this mode, the typical consumption can greatly vary in function of parameter settings (WU 
period without RF activity and Swing Count defining the RF burst duration). Using default 
settings, consumption in the range of 100 pA can be achieved. 

Tag Detector is a state where CR95HF is able to detect an RF event, a wake-up will occur 
when a tag sufficiently modifies the antenna load and is detected by the CR95HF. 

An Idle command example when wake-up source is Tag Detection (0x02): 

>>>0x07 0E 02 21 00 79 01 18 00 20 60 60 64 74 3F 08 

The same command can be used mixing Tag Detection and the IRQJN pin (0 x0a) as a 
wake-up source: 

>>>0x07 0E 0A 21 00 79 01 18 00 20 60 60 64 74 3F 08 

The tag detection sequence is defined by dedicated parameters: 

• WU source (Byte 3) (Wake-up source register on page 53) 

- The Timeout bit (bit 0) must be set to T in order to manage a certain number of 
emitted bursts. Otherwise, bursts will be sent ind efinitely until a stop event occurs 
(for example, tag detection or a low pulse on pin IRQJN). 

- The Tag Detect bit (bit 1) must be set to T to enable RF burst emissions. 

- It is recommended to also set Bits 3 or 4 to T to ensure that it is possibl e to leav e 
Tag Detect mode via an external event (for example, a low pulse on pin IRQJN). 

• WU period (Byte 10): Defines the period of inactivity ^inactive) between two RF bursts: 

tiNACTiVE = (WuPeriod + 2) * t REF 

• OscStart, DacStart (Bytes 11 and 12): Define the set-up time of the HFO and Digital 
Analog Converter, respectively. In general, 3 ms is used both set-up times. 

HFO | DAC set-up time = (OscStart | DacStart) * t L 

• DacDataL, DacDataH (Bytes 13 and 14): Reference level for Tag Detection (calculated 
during the tag detection calibration process). 

• SwingsCnt (Byte 15): Represents the number of 13.56-MHz swing allowed during a 
Tag Detection burst. We recommend using 0x3 f. 
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• Maxsleep (Byte 16): The CR95HF emits (MaxSIeep +1) bursts before leaving Tag 
Detection mode if bit 0 (Timer Out) of the WU source register is set to ‘T. Otherwise, 
when this bit is set to ‘O’, a burst is emitted indefinitely. 

Note: Bytes 4 to 9 should be used as shown in the examples in Section 5.6: Idle command (0x07) 

description. 

Note that the MaxSIeep value is coded on the 5 least significant bits, thus: 

0x00 < MaxSIeep < Ox IF. 

All the previously described command parameters must be chosen accordingly for the initial 
tag detection calibration when setting up the CR95HF. 

Their value will impact tag detection efficiency, and CR95HF power consumption during Tag 
Detection periods. 

5.6.5 Tag detection calibration procedure 

The Idle command allows the use of a tag detection as a wake-up event. Certain 
parameters of the Idle command are dedicated to setting the conditions of a tag detection 
sequence. 

During the tag detection sequence, the CR95HF regularly emits RF bursts and measures 
the current in the antenna driver Idrive using the internal 6-bit DAC. 

When a tag enters the CR95HF antenna RF operating volume, it modifies the antenna 
loading characteristics and induces a change in Idrive- an d consequently, the DAC data 
register reports a new value. 

This value is then compared to the reference value established during the tag detection 
calibration process. This enables the CR95HF to decide if a tag has entered or not its 
operating volume. 

The reference value (DacDataRef) is established during a tag detection calibration process 
using the CR95HF application setting with no tag in its environment. 

The calibration process consists in executing a tag detection sequence using a well-known 
configuration, with no tag within the antenna RF operating volume, to determine a specific 
reference value (DacDataRef) that will be reused by the host to define the tag detection 
parameters (DacDataL and DacDataH). 

During the calibration process, DacDataL is forced to 0x00 and the software successively 
varies the DacDataH value from its maximum value (OxFE) to it minimum value (0x00). At 
the end of the calibration process, DacDataRef will correspond to the value of DacDataH for 
which the wake-up event switches from Timeout (no tag in the RF field) to tag detected. 

To avoid too much sensitivity of the tag detection process, we recommend using a guard 
band. This value corresponds to 2 DAC steps (0x08). 

Recommended guard band value: 

DacDataL = DacDataRef - Guard and DacDataH = DacDataRef + Guard 

The parameters used to define the tag detection calibration sequence (clocking, set-up time, 
burst duration, etc.) must be the same as those used for the future tag detection sequences. 

When executing a tag detection sequence, the CR95HF compares the DAC data register 
value to the DAC Data parameter values (DacDataL and DacDataH) included in the Idle 
command. The CR95HF will exit WFE mode through a Tag Detection event if the DAC data 
register value is greater than the DAC Data parameter high value (DacDataH) or less than 
the DAC Data parameter low value (DacDataL). Otherwise, it will return to Ready state after 
a Timeout. 
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An efficient 8-step calibration algorithm is described in Example of tag detection calibration 
process on page 54. 

An example of a basic Idle command used during the Tag Detection Calibration process: 

>>>0x07 0E 03 Al 00 F8 01 18 00 20 60 60 00 xx 3F 01 

where xx is the DacDataH value. 

An example of a tag detection sequence is provided in Example of tag detection command 
using results of tag detection calibration on page 57. 


5.7 Read Register (RdReg) command (0x08) description 

This command is used to read the Wakeup register. 


Table 20. RdReg command description 


Direction 

Data 

Comments 

Example 


0x08 

Command code 

Ex 1. >>>0x0803690100 

Reads the ARC B register. C) 


0x03 

Length of data 

Host to 

CR95HF 

0x62 or 0x69 

Register address 


0x01 

Register size 

Ex 2. >>>0x0803620100 

Reads the Wake-up event register. 


0x00 

ST Reserved 


0x00 

Result code 

<<<0x000101 Wake-up by Timeout (Ex. 1) 


<Len> 

Length of data (= 
RegCount) 

<<<0x000102 Wake-up by Tag Detect (Ex. 
1) 

<<<0x000113 Depth = 1, Gain = 3 (Ex. 2) 

<« 0x000113 (ARC_B register) 

Depth = 1, Gain = 3 (Ex. 2). See Write 
Register description for more information on 
received data. 

CR95HF to 

Host 

<RegData> 

Register data 

CR95HF to 

0x82 

Error code 

<<<0x8200 Invalid command length 

Host 

0x00 

Length of data 


1. This command must be preceded by the setting of the ARCJ3 register index (0x0903680004) . 


Note: The Management of the Analog Register Configuration register (ARCJ3J is described in 

Section 5.8: Write Register (WrReg) command (0x09) description. 
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5.8 Write Register (WrReg) command (0x09) description 

The Write Register (WrReg) command (0x09) is used to: 

• set the Analog Register Configuration address index value before reading or 
overwriting the Analog Register Configuration register (ARC_B) value 

• set the Timer Window (TimerW) value used to improve CR95HF demodulation when 
communicating with ISO/IEC 14443 Type A tags 

• set the AutoDetect Filter used to help synchronization of CR95HF with ISO/IEC 18092 
tags 

• configure the HF2RF bit( a ) to manage l cc RF (V PS TX ) consumption in Ready state 

5.8.1 Improving RF performance 

Adjusting the Modulation Index and Receiver Gain parameters helps improve application 
behavior. 

The default value of these parameters (Table 24) is set by the ProtocolSelect command, 
but they can be overwritten using the Write Register (WrReg) command (0x09). Table 22 
and Table 23 list possible values for the Modulation Index and Receiver Gain parameters 
respectively. 

This new configuration is valid until a new ProtocolSelect or Write Register (of register 
ARC_B) command is executed. Register values are cleared at power off. 


Table 21. WrReg command description (Modulation Index and Receiver Gain) 


Direction 

Data 

Comments 

Example 


0x09 

Command code 



0x03 or 

0x04 

Length of data 



0x68 

Analog Register Configuration address 
index 

>>>0x090468010113 

Update ARC_B value to 0x13 

Host to 
CR95HF 

0x00 or 

0x01 

Flag Increment address or not after Write 
command 

>>>0x0903680001 


0x01 

Index pointing to the Modulation Index and 
Receiver Gain values in the ARC_B 
register (0x01) (See Section 5.8.1) 

Set Analog Register Index to 
0x01 (ARC_B) (1 > 


OxXX 

New value for Modulation Index and 
Receiver Gain nibbles (See Section 5.8.1) 


CR95HF to 

0x00 

Result code 

«<0x0000 

Host 

0x00 

Length of data (= RegCount) 

Register written 


1. This command must be executed before reading the ARC_B register (0x0803690100). 


The default value of these parameters (Table 24) is set by the ProtocolSelect command, 
but they can be overwritten using the Write Register (WrReg) command (0x09). 


a. When the HF2RF bit is ‘O', Reader mode is possible (default mode). When set to T, V PS TX power 
consumption is reduced (Ready mode). 
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This new configuration is valid until a new ProtocolSelect or Write Register (of register) 
command is executed. Register values are cleared at power off. 


How to modify Analog Register Configuration register (ARC_B) values 


1 . Use the ProtocolSelect command (0x02) to select the correct communication 
protocol. 

For example, to select the ISO/IEC 18092 protocol: 

Send ProtocolSelect command: >>>0x02020451 

CR95HF reply: <<<0x0000 

2. Read the Analog Register Configuration register (ARC_B) value. 

a) Write the ARC_B register index at 0x01: >>>0x0903 680001 

CR95HF reply: <<<0x0000 

b) Read the ARCB register value: >>>0x0803 690100 

CR95HF reply: <«0x015F 

In this example, the ARC_B register value is 0x5F, where “5” is the Modulation Index 
and “F” is the Receiver Gain. 


3. 


4. 


Modify the Modulation Index and Receiver Gain values with 0x23. 


Write the ARC_B register index: >>>0x090468010123 

CR95HF reply: <<<0x0000 


Read the Analog Configuration register (ARC B) value. 


a) Write the ARC_B register index at 0x01: 
CR95HF reply: 

b) Read the ARC_B register value: 
CR95HF reply: 


>>>0x0903680001 

<«0x0000 

>>>0x0803690100 

<«0x0123 


Modulation Index and Receiver Gain values 


Table 22. Possible Modulation Index values 


Code 

1 

2 

3 

4 

5 

6 

D 

Modulation Index ^ 

10% 

17% 

25% 

30% 

33% 

36% 

95% 


1. Characterized only using ISO/IEC 10373 test set-up. 

Table 23. Possible Receiver Gain values 


Code 

0 

1 

3 

7 

F 

Receiver Gain ^ 

34 dB 

32 dB 

27 dB 

20 dB 

8 dB 


1. Characterized by design simulation. 
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Default code per protocol 

Table 24. ARC B default code for available Reader protocols 


Communication 

protocol 

Default 

value 

Recommended 
values for CR95HF 
demo board 

Possible 

Modulation Index 
values (MS nibble) 

Possible Receiver 
Gain values 
(LS nibble) 

ISO/IEC 14443 
Type A reader 

OxDF 

OxDI or 0xD3 

OxD 

0x0, 0x1,0x3, 0x7 or 
OxF 

ISO/IEC 14443 
Type B reader 

0x2 F 

0x20 

0x1, 0x2, 0x3 or 0x4 

0x0, 0x1, 0x3, 0x7 
or OxF 

ISO/IEC 18092 
reader 

0x5 F 

0x20 

0x1, 0x2, 0x3 or 0x4 

0x0, 0x1, 0x3, 0x7 
or OxF 

ISO/IEC 15693 
reader 30% 

0x53 

0x50 

0x4, 0x5 or 0x6 

0x0, 0x1, 0x3, 0x7 
or OxF 

ISO/IEC 15693 
reader 100% 

0xD3 

OxDO 

OxD 

0x0, 0x1, 0x3, 0x7 
or OxF 


5.8.2 Improving frame reception for ISO/IEC 14443 Type A tags 

To improve CR95HF demodulation when communicating with ISO/IEC 14443 Type A tags, it 
is possible to adjust the synchronization between digital and analog inputs by fine-tuning the 
Timer Window (TimerW) value. This can be done using the Write Register (WrReg) 
command to set a new TimerW value (min. 0x50, max. 0x60). The recommended value is 
0x56 or 0x58 when using the CR95HF demo board. 

The default value of this parameter (0x52) is set by the ProtocolSelect command, but it can 
be overwritten using the WrReg command (0x09). 


Table 25. WrReg command description (Timer Window) 


Direction 

Data 

Comments 

Example 


0x09 

Command code 



0x03 or 

0x04 

Length of data 


Host to 
CR95HF 

0x3A 

Timer Window (TimerW) value 

»>0x09043A005804 

0x00 or 

0x01 

Flag Increment address or not after Write 
command 

Set recommended TimerW 
value. 


OxXX 

Set TimerW value (recommended value is 
0x56 or 0x58) 



0x04 

TimerW value confirmation 


CR95HF to 

0x00 

Result code 

«<0x0000 

Host 

0x00 

Length of data (= RegCount) 

Register written 


5.8.3 Improving RF reception for ISO/IEC 18092 tags 

To improve CR95HF reception when communicating with ISO/IEC 18092 tags, it is possible 
to enable an AutoDetect filter to synchronize ISO/IEC 18092 tags with the CR95HF. This 
can be done using the Write Register (WrReg) command to enable the AutoDetect filter. 
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By default, this filter is disabled after the execution of the ProtocolSelect command, but it 
can be enabled using the WrReg command (0x09). 


5.9 BaudRate command (OxOA) description 

This command changes the UART baud rate. 


Table 26. BaudRate command description 


Direction 

Data 

Comments 

Example 


OxOA 

Command code 



0x01 

Length of data 




New Baud Rate = 

13.56 /(2*<BaudRate>+2) Mbps 

Baud rate 

255: 13.56/512 -26.48 Kbps 


Host to 


254: 13.56/510 -26.59 Kbps 


CR95HF 

<BaudRate> 

253: 13.56/508 -26.7 Kbps 




117: 13.56/236 -57.7 Kbps (Value after 
power-up) 




2: 13.56/6 -2.26 Mbps 

1: RFU 

0: RFU 


CR95HF to 
Host 

0x55 

Code response of 0x55 

<<<0x55 

New baud rate is used 
to reply 


Caution: If the BaudRate command is not correctly executed, the baud rate value will remain 

unchanged. 


5.10 Echo command (0x55) description 

The Echo command verifies the possibility of communication between a Host and the 


CR95HF. 

Table 27. Echo command description 


Direction 

Data 

Comments 

Example 

Host to CR95HF 

0x55 

Command code 


CR95HF to Host 

0x55 

Code response 

»> 0x55: Sends an Echo command 
<« 0x55: Response to an Echo 
command 



DoclD018669 Rev 12 


41/77 


















Electrical characteristics 


CR95HF 


6 

6.1 


Note: 


Electrical characteristics 

Absolute maximum ratings 


Table 28. Absolute maximum ratings 


Symbol 

Parameter 

Value 

Unit 

VPS_Main 

Supply voltage ® 

-0.3 to 7.0 

V 

VPS_TX 

Supply voltage (RF drivers) 

-0.3 to 7.0 

V 

V IO 

Input or output voltage relative to ground 

-0.3 to VPS_Main +0.3 

V 

^MaxCarrier 

Maximum input voltage (pins RX1 and RX2) 

±14.0 

V 

Ta 

Ambient operating temperature 

-25 to +85 

°c 

Ambient operating temperature (RF mode) 

-25 to +85 

t stg 

Storage temperature (Please also refer to package 
specification). 

-65 to +150 

°c 

"•"lead 

Lead temperature during soldering 

See note® 

°c 

V ESD 

Electrostatic discharge voltage according to 
JESD22-A114, Human Body Model 

2000 

V 

p (3) 

hdt 

Total power dissipation per package 

1 

w 


1. To properly reset the device, VPS_Main must be tied to OV before executing the start-up sequence. 

2. Compliant with JEDEC standard J-STD-020D (for small-body, Sn-Pb or Pb assembly), the ST ECOPACK® 
7191395 specification, and the European directive on Restrictions on Hazardous Substances (RoHS 
directive 2011/65/EU of July 2011). 

3. Depending on the thermal resistance of package. 

Stresses listed above may cause permanent damage to the device. This is a stress rating 
only and functional operation of the device at these or any other conditions above those 
indicated in the operational sections of the specification is not implied. 

Exposure to absolute maximum rating conditions for extended periods may affect device 
reliability. 
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6.2 DC characteristics 


Table 29. DC characteristics 


Symbol 

Parameter 

Condition 

Min. 

Typ. 

Max. 

Unit 

VPSJVIain 

Supply voltage 


2.7 

3.0 

5.5 

V 

VPS_TX 

Supply voltage (RF 
drivers) 


2.7 

3.0 

5.5 

V 

V|L 

Input low voltage (I/Os) 


0 


0.2 x VPSJVIain 

V 

V,H 

Input high voltage (I/Os) 


0.7 x VPSJVIain 


VPSJVIain 

V 

X 

o 

> 

Output high voltage (I/Os) 

Iqh = - 8 pA 

0.7 x VPSJVIain 


VPSJVIain 

V 

V OL 

Output low voltage (I/Os) 

'oLMAX = 500 MA 

0 


0.15 x 
VPSJVIain 

V 

POR 

Power-on reset voltage 



1.8 


V 


6.3 Power consumption characteristics 

T a = -25°C to 85°C, unless otherwise specified. 


Table 30. Power consumption characteristics (VPS Main from 2.7 to 3.3 V) 


Symbol 

Parameter 

Condition 

Typ. 

Max. 

Unit 

!cc (Vps) 
Power-up 

Supply current in power-up state 

T A = 25°C 

200 

600 

pA 

Icc (Vps) 
Hibernate 

Supply current in Hibernate state 

T a = 25°C 

1 

5 

pA 

Icc (Vps) Sleep 

Supply current in Sleep state 

T A = 25°C 

20 

80 

pA 

Icc (Vps) Ready 

Supply current in Ready state 

T A = 25°C 

2.5 

5.0 

mA 

Icc (Vps) Tag 
Detect 

Average supply current in Tag Detector state 

T a = 25°C, 

4 RF bursts 
per second 

50 

100 

pA 


The CR95HF supports two VPS_TX supply ranges for RF drivers: 2.7V to 3.3V or 4.5V to 
5.5V. Antenna matching circuit must be defined accordingly. 


Table 31. Power consumption characteristics (VPSTX from 2.7 to 3.3 V) 


Symbol 

Parameter 

Condition 

Typ. 

Max. 

Unit 

l C c RF (V PS TX ) 
RF Field ON 

Supply current in RF Field (Reader mode) ^ 

T a = 25°C 

70 

100 

mA 

l C c RF (V PS TX ) 
RF Field OFF 

Supply current in RF Field (Ready mode) ^ 

T a = 25°C 


200 

pA 

l C c RF (Vp S T x) 
Tag Detect 

Peak^ current during Burst detection 

T a = 25°C 

70 

100 

mA 


1. Parameter measured using recommended output matching network. (Z load is 27 Qand 0°). 


2. This consumption can be reduced to approximately 2 pA (typ.) by setting a control bit (bit HF2RF) to T using command 
090468010710. In this case, Reader mode is not available. 

To re-enable Reader mode, reset the HF2RF bit to ‘0’ using the command 090468010700 or execute a new 
ProtocolSelect command. 

3. The maximum differential input voltage between pins RX1 and RX2 (VRx1-Rx2) has a peak-peak of 18 V. 
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Table 32. Power consumption characteristics (VPS TX from 4.5 to 5.5 V) 


Symbol 

Parameter 

Condition 

Typ. 

Max. 

Unit 

l C c RF (V PS TX ) 
RF Field ON 

Supply current in RF Field (Reader mode) ^ 

T a = 25°C 

120 

200 

mA 

l C c RF (V PS TX ) 
RF Field OFF 

Supply current in RF Field (Ready mode) ^ 

T a = 25°C 


300 

pA 

l C c RF (Vps ix) 
Tag Detect 

Peak^ current during Burst detection 

T a = 25°C 

120 

200 

mA 


1. Parameter measured using recommended output matching network. (Z load is 16 tland 0°). 


2. This consumption can be reduced to approximately 2 pA (typ.) by setting a control bit (bit HF2RF) to ‘1' using command 
090468010710. In this case, Reader mode is not available. 

To re-enable Reader mode, reset the HF2RF bit to ‘0’ using the command 090468010700 or execute a new 
ProtocolSelect command. 

3. The maximum differential input voltage between pins RX1 and RX2 (VRx1-Rx2) has a peak-peak of 18 V. This voltage can 
be limited by adding a damping resistor in parallel of the antenna or between ST_R0 and Ground. 
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6.4 SPI characteristics 

The CR95HF supports (CPOL = 0, CPHA = 0) and (CPOL = 1, CPHA = 1) modes. 


Table 33. SPI interface characteristics 


Symbol 

Parameter 

Condition 

Min. 

Max. 

Unit 

f SCK 
^ tc(SCK) 

SPI clock frequency 



2.0 

MHz 

V|L 

Input low voltage 



0.3 x Vp 5 

V 

V,H 

Input high voltage 


0.7 x Vpg 


V OL 

Output low voltage 



0.4 x Vpg 

I 

o 

> 

Output high voltage 


0.7 x V PS 


t (1) 

tSU/NSS) 

NSS setup time 


70 


ns 

t f 1 ) 

th/NSS) 

NSS hold time 


0 


t (1) 

tCH/SCKL) 

Clock low time 


200 


ns 

t 0) 

tCH/SCKH) 

Clock high time 


200 


tsu ( si) (1) 

Data slave Input setup time 


20 


ns 

t h( si) (1) 

Data slave Input hold time 


80 


tv(SO) (1) 

Data slave output valid time 



80 

ns 

t h (SO) (1) 

Data slave output hold time 

After enable 
edge 

150 


C b_SPI_IN 

Capacitive load for input pins NSS, 
CLK, MOSI 



3 

PF 

C b_SPI_OUT 

Capacitive load for input pins 

MOSI 



20 

PF 


1. Values based on design simulation and/or characterization results, and not on tested in production. 


Figure 14. SPI timing diagram (Slave mode and CPOL = 0, CPHA = 0) 
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Figure 15. SPI timing diagram (Slave mode and CPOL = 1, CPHA = 1) 
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6.5 RF characteristics 

Test conditions are T A = 0°C to 50°C, unless otherwise specified. 


Table 34. Reader characteristics 


Symbol 

Parameter 

Min. 

Typ. 

Max. 

Unit 

f c 

Frequency of operating field (carrier frequency) 

13.553 

13.56 

13. 567 

MHz 


Carrier modulation index* 1 ) ISO/IEC 14443-A 



100 



ISO/IEC 14443-B 

8 


14 


Ml Carrier 

ISO/IEC 18092 

8 


14 

% 


ISO/IEC 15693 (10% modulation)* 2 ) 

10 


30 



ISO/IEC 15693 (100% modulation) 

80 


100 


Transmitter specifications (VPS_TX = 2.7 to 3.3 V) 


Z 0 ut differential impedance between TX1 and 
TX2' 1 ) 


27 


a 


Output power for 3V operation on pin VPS_TX * 1 )* 2 ) 


55 


mW 

Transmitter specifications (VPS_TX = 4.5 to 5.5 V) 


Z OU y differential impedance between TX1 and 
TX2' 1 ) 


16 


a 


Output power for 5V operation on pin VPS_TX * 1 ) * 2 ) 


230 


mW 

Receiver specifications 


Small signal differential input resistance 
(Rx1/Rx2) (1) 


100 


k£2 

VRx1-Rx2 

Differential input voltage between pins RX1 and 
RX2* 3 ) 



18 

V 


Small signal differential input capacitance 
(CX1/CX2)* 1 ) 


22 


PF 


Sensitivity (106 Kbps data rate)* 4 ) 


8 


mV 


1. Maximum values based on design simulation and/or characterization results, and not tested in production. 

2. Parameter measured on samples using recommended output matching network. (Z load is 27 £2and 0°.) 

3. This voltage can be limited by adding a damping resistor in parallel of the antenna or between ST_R0 and 
Ground. 

4. Based on ISO/IEC 10373-6 protocol measurement. The reader sensitivity corresponds to the load 
modulation value of the REQ reply sent by an ISO reference card when decoded by the CR95HF. 
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6.6 Oscillator characteristics 

The external crystal used for this product is a 27.12 MHz crystal with an accuracy of 
±14 kHz. 


Table 35. HFO 27.12 MHz oscillator characteristics* 1 )* 2 ) 


Symbol 

Parameter 

Conditions 

Min. 

Typ. 

Max. 

Unit 

*XTAL 

Oscillator frequency 



27.12 


MHz 

Rp 

Feedback resistor 



2 


MO 

c 

Recommended load capacitance 
versus equivalent serial resistance of 
the crystal (R s )* 3 ) 

Rg = 30 O 


6 


PF 

t (4) 

tSUfHFO) 

Startup time 

Vpg is stabilized 


6 

10 

ms 


1. Resonator characteristics given by the crystal/ceramic resonator manufacturer. 

2. Based on characterization, not tested in production. 


3. The relatively low value of the R F resistor offers a good protection against issues resulting from use in a 
humid environment, due to the induced leakage and the bias condition change. However, it is 
recommended to take this point into account if the Host is used in tough humidity conditions. 

4. tgyy-ipQ) is the startup time measured from the moment it is enabled (by software) to a stabilized 27.12 MHz 
oscillation is reached. This value is measured for a standard crystal resonator and it can vary significantly 
with the crystal manufacturer. 

For C L i and C L2 , it is recommended to use high-quality external ceramic capacitors in the 
10 pF to 20 pF range (typ.), designed for high-frequency applications, and selected to match 
the requirements of the crystal or resonator (see Figure 16). C u and C L2 are usually the 
same size. The crystal manufacturer typically specifies a load capacitance which is the 
series combination of C L i and C L2 . 



Note: For C L1 and C L2 it is recommended to use high-quality ceramic capacitors in the 10 pF to 

20 pF range selected to match the requirements of the crystal or resonator. C L1 and C L2 are 
usually the same size. The crystal manufacturer typically specifies a load capacitance which 
is the series combination of C L1 and C L2 . 

Load capacitance C L has the following formula: C L = C L1 x C L2 /(C L1 + C L2 ) + C stmy where 
Cstray ,s P' n capacitance and board or trace PCB-related capacitance. Typically, it is 

between 2 pF and 1 pF. 
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Package information 


In order to meet environmental requirements, ST offers these devices in different grades of 
ECOPACK® packages, depending on their level of environmental compliance. ECOPACK® 
specifications, grade definitions and product status are available at: www.st.com. 
ECOPACK® is an ST trademark. 


7.1 VFQFPN32 package information 

Figure 17. VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very thin profile fine pitch 

quad flat package outline 


Seating plane 




2 



ddd 

C 




A3 


n 

A1 



42_ME_AMKOR_V1 


1. Drawing is not to scale. 


fcy/ 
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Table 36. VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very thin profile fine pitch 
quad flat package mechanical data 


Symbol 

millimeters 

inches* 1 * 

Min 

Typ 

Max 

Min 

Typ 

Max 

A 

0.800 

0.900 

1.000 

0.0315 

0.0354 

0.0394 

A1 

0.000 

0.020 

0.050 

0.0000 

0.0008 

0.0020 

A3 

- 

0.200 

- 

- 

0.0079 

- 

b 

0.180 

0.250 

0.300 

0.0071 

0.0098 

0.0118 

D 

4.850 

5.000 

5.150 

0.1909 

0.1969 

0.2028 

D2 

3.500 

3.600 

3.700 

0.1378 

0.1417 

0.1457 

E 

4.850 

5.000 

5.150 

0.1909 

0.1969 

0.2028 

E2 

3.500 

3.600 

3.700 

0.1378 

0.1417 

0.1457 

e 

- 

0.500 

- 

- 

0.0197 

- 

L 

0.300 

0.400 

0.500 

0.0118 

0.0157 

0.0197 

ddd 

- 

- 

0.050 

- 

- 

0.0020 


1. Values in inches are converted from mm and rounded to 4 decimal digits. 
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Figure 18. VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very thin profile fine pitch 
quad flat package recommended footprint 



42_FP_AMKOR_B_V1 


1. Dimensions are expressed in millimeters. 
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8 Part numbering 


Table 37. Ordering information scheme 

Example: CR 95 HF -V MD 5 T 



Not all combinations are necessarily available. For a list of available options (speed, 
package, etc.) or for further information on any aspect of this device, please contact your 
nearest STMicroelectronics Sales Office. 

Note: Parts marked as “ES” or “E” are not yet qualified and therefore not approved for use in 

production. ST is not responsible for any consequences resulting from such use. In no event 
will ST be liable for the customer using any of these engineering samples in production. 
ST’s Quality department must be contacted prior to any decision to use these engineering 
samples to run a qualification activity. 
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Appendix A Additional Idle command description 


This section provides examples of use for the Idle command. 

The wake-up source is the third of the 16 bytes in the Idle command. This byte specifies 
authorized Wake-up events. This revision now also provides the capability to set the LFO 
frequency in WFE mode. 

The LFO frequency and the authorized wake-up source settings are stored in the Wake-up 
source register as the parameters of the Idle command. 

The Wake-up event is updated by the CR95HF when it exits WFE mode. 

The contents of the Wake-up event register can be read using the Read Register command 
or in the CR95HF reply to the Idle command. 


Table 38. Wake-up source register 


Bits [7:6] 

Bit 5 

Bit 4 

Bit 3 

Bit 2 

Bit 1 

BitO 

LFO frequency 

RFU (1 > 

IRQ on pin 
SPI_SS 

IRQ on pin 
IRQJN 

RFU^ 1 ) 

Tag Detect 

Timeout 


1. Must be set to‘O’. 


Table 39. Wake-up event register 


Bits [7:6] 

Bit 5 

Bit 4 

Bit 3 

Bit 2 

Bit 1 

BitO 

LFO frequency 

RFU 

IRQ on pin 
SPI_SS 

IRQ on pin 
IRQJN 

RFU 

Tag Detect 

Timeout 


Bits [7:6] define the LFO frequency (f|_Fo) : 

00: 32 kHz 01: 16 kHz 
10: 8 kHz 11: 4 kHz 

Bit 4: W hen set, the CR95HF will wake up when an external interrupt (low level on pin 
SPI_SS) is detected. This is useful for UART communication. 

Bit 3: W hen set, the CR95HF will wake up when an external interrupt (low level on pin 
IRQJN) is detected. This is useful for SPI communication. It is recommended to set this bit 
to T in order to recover in the event of a system crash. 

Bit 1: When set, the CR95HF will wake up when a tag is detected in the RF field. This bit 
must also be set during Tag Detection calibration or during a Tag Detection sequence. 

Bit 0: When set, the CR95HF will wake up and return to Ready state at the end of a 
predefined cycle. The Timeout (TO) value is defined by the MaxSIeep and Wake-up period: 
TO = (MaxSIeep *(WuPeriod+1)*t REF 

t REF = 256*t L = 8 ms (f LF0 = 32 kHz), mean power consumption in Sleep mode is 25 pA 
t REF = 256*t L = 64 ms (f LFO = 4 kHz), mean power consumption in Sleep mode is 20 pA 

Note: Note that: 0x00 < MaxSIeep < 0x1 F. 

This bit must be set when using the timer as a possible wake-up source. It must be set 
during Tag Detection Calibration to force a wake-up after the first Tag Detection trial. 
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Appendix B Example of tag detection calibration process 

The following script works on the DEMO_CR95HF evaluation board and with the CR95HF 
developement software available from the ST internet site. 

This is a dichotomous approach to quickly converge to the DacDataRef value for which a 
wake-up event switches from tag detection to Timeout. In this process, only the DacDataH 
parameter is changed in successive Idle commands. And we look at the wake-up event 
reply to decide the next step. 

00 01 02 corresponds to a Tag Detect, 

00 01 01 corresponds to a Timeout. 

REM, Tag Detection Calibration Test 

REM, Sequence: Power-up Tag Detect Wake-up by Tag Detect (1 try 
measurement greater or equal to DacDataH) or Timeout 

REM, CMD 07 0E 03 A100 D801 1800 01 60 60 00 XX 3F 00 

REM, 03 WU source = Tagdet or Timeout 

REM, A100 Initial Dac Compare 

REM, F801 Initial Dac Compare 

REM, 1800 HFO 

REM, 20 Wup Period 32 Inactivity period = 256ms (LFO @ 32kHz) 

REM, 60 Osc 3ms (LFO @ 32kHz) 

REM, 60 Dac 3ms (LFO @ 32kHz) 

REM, 00 DacDataL = minimum level (floor) 

REM, xx DacDataH 00 = minimum level (ceiling) 

REM, 3F Swing 13.56 4.6 us 

REM, 01 Maximum number of Sleep before Wakeup 2 

REM, Tag Detection Calibration Test 

REM, During tag detection calibration process DacDataL = 0x00 

REM, We execute several tag detection commands with different 
DacDataH values to determine DacDataRef level corresponding to 
CR95HF application set-up 

REM, DacDataReg value corresponds to DacDataH value for which Wake- 
up event switches from Timeout (0x01) to Tag Detect (0x02) 

REM, Wake-up event = Timeout when DacDataRef is between DacDataL 
and DacDataH 

REM, Search DacDataref value corresponding to value of DacDataH for 
which Wake-up event switches from Tag Detect (02) to Timeout(01) 
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REM, Step 0: force wake-up event to Tag Detect (set DacDataH = 0x00) 
REM, With these conditions Wake-Up event must be Tag Detect 
»> CR95HFDLL_STCMD, 01070E03A100F801180020606000003F01 
«< 000102 

REM, Read Wake-up event = Tag Detect (0x02); if not, error . 

REM, Step 1: force Wake-up event to Timeout (set DacDataH = OxFC 
REM, With these conditions, Wake-Up event must be Timeout 
»> CR95HFDLL_STCMD, 01070E03A100F801180020606000FC3F01 
«< 000101 

REM, Read Wake-up event = Timeout (0x01); if not, error . 

REM, Step 2: new DacDataH value = previous DacDataH + /- 0x80 

REM, If previous Wake-up event was Timeout (0x01) we must decrease 
DacDataH (-0x80) 

»> CR95HFDLL_STCMD, 01070E03A100F8011800206060007C3F01 
«< 000101 

REM, Read Wake-up event = Timeout (0x01) or Wake-up event = Tag 
Detect (0x02) 

REM, Step 3: new DacDataH value = previous DacDataH +/- 0x40 

REM, If previous Wake-up event was Timeout (0x01), we must decrease 
DacDataH (-0x40); else, we increase DacDataH (+ 0x40) 

»> CR95HFDLL_STCMD, 01070E03A100F8011800206060003C3F01 

«< 000102 

REM, Read Wake-up event = Timeout (0x01) or Wake-up event = Tag 
Detect (0x02) 

REM, Step 4: new DacDataH value = previous DacDataH + /- 0x20 

REM, If previous Wake-up event was Timeout (0x01), we must decrease 
DacDataH (-0x20); else, we increase DacDataH (+ 0x20) 

»> CR95HFDLL_STCMD, 01070E03A100F8011800206060005C3F01 

«< 000102 

REM, Read Wake-up event = Timeout (0x01) or Wake-up event = Tag 
Detect (0x02) 
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REM, Step 5: new DacDataH value = previous DacDataH + /- 0x10 

REM, If previous Wake-up event was Timeout (0x01), we must decrease 
DacdataH (-0x10); else, we increase DacDataH (+ 0x10) 

»> CR95HFDLL_STCMD, 01070E03A100F8011800206060006C3F01 

«< 000102 

REM, Read Wake-up event = Timeout (0x01) or Wake-up event = Tag 
Detect (0x02) 

REM, Step 6: new DacDataH value = previous DacDataH + /- 0x08 

REM, If previous Wake-up event was Timeout (0x01), we must decrease 
DacDataH (-0x08); else, we increase DacDataH (+ 0x08) 

»> CR95HFDLL_STCMD, 01070E03A100F801180020606000743F01 

«< 000101 

REM, Read Wake-up event = Timeout (0x01) or Wake-up event = Tag 
Detect (0x02) 

REM, Step 7; new DacDataH value = previous DacDataH + /- 0x04 

REM, If previous Wake-up event was Timeout (0x01), we must decrease 
DacDataH (-0x04); else, we increase DacDataH (+ 0x04) 

»> CR95HFDLL_STCMD, 01070E03A100F801180020606000703F01 

«< 000101 

REM, Read Wake-up event = Timeout (0x01) or Wake-up event = Tag 
Detect (0x02) 


REM, If last Wake-up event = Tag Detect (0x02), search DacDataRef = 
last DacDataH value 

REM, If last Wake-up event = Timeout (0x01), search DacDataRef = 
last DacDataH value -4 


REM, For tag detection usage, we recommend setting DacDataL = 
DacDataRef -8 and DacDataH = DacDataRef +8 


»> CR95HFDLL_STCMD, 01070E0B21007801180020606064743F01 
«< 000101 
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Appendix C Example of tag detection command using 

results of tag detection calibration 

The following script works on the DEMO_CR95HF evaluation board and with the CR95HF 
development software available from the ST internet site. 

This is an example of a Tag Detection command when a tag is not present in the RF 
operating volume using the CR95HF: 

»> CR95HFDLL_STCMD, 01 070E0B21007801180020606064743F01 
<<< 000101 Wake-up event = Timeout (0x01) 

»> CR95HFDLL_STCMD, 01 0803620100 
«< 000101 

This is an example of a Tag Detection command when a tag is present in the RF operating 
volume using the CR95HF: 

»> CR95HFDLL_STCMD, 01 070E0B21007801180020606064743F01 
<<< 000102 Wake-up event = Tag Detect (0x02) 

»> CR95HFDLL_STCMD, 01 0803620100 
«< 000102 
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Appendix D Examples of CR95HF command code to 

activate NFC Forum and ISO/IEC 15693 tags 


The following script works on the DEMO_CR95HF evaluation board and with the CR95HF 
developement software available from the ST internet site. 

This section provides examples of CR95HF command code used to activate NFC Forum 
and ISO/IEC 15693 tags using CR95HF development software. 

cr95hfdll_stcmd: Is the standard CR95HF frame exchange command. In this command, 
the first byte 01 is not sent, it is only requested by the CR95HF development software in 
order to recognize if it is a user or service command. 

CR9 5hfdll_sendrecv: Is the encapsulated CR95HF SendReceive command for which 
command codes, number of bytes, and CRC are automatically appended to the parameter. 

In this section, 

• The CR95HF command overhead (command code, length of data and transmission 
flag) is in black. 

• The Tag instruction is in blue. 

• The CR95HF response overhead (result code, length of data and status) is in green. 

• The Tag response is in red. 

When the CRC append option is set in the Protocol Select command, the CRC is 
automatically appended by the CR95HF, but the CRC is not visible in the instruction log file. 

When the CRC is present in the command or response, CRC reply is in italics. 

The following symbols correspond to: 

>» Frame sent by Host to CR95HF 
<« Frame received by Host from CR95HF 

D.1 ISO/IEC 14443 Type A 

D.1.1 NFC Forum Tag Type 1 (Topaz) 

REM, CR95HF code example to support NFC Forum Tag Type 1 14443_A 
REM, TEST TOPAZ 14443A (UID 6E567A00) 

REM, first byte 01 in CR95HFDLL_STCMD is only requested by CR95HF 
Development SW 

REM, RFOFF 

»> CR95HFDLL_STCMD, 01 02020000 
«< 0000 

REM, TEST TOPAZ 14443A (UID 6E567A00) 

REM, Sel Prot 14443A option TOPAZ 
»> CR95HFDLL_STCMD, 01 020402000300 
«< 0000 
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REM, Optimization of synchronization between digital and analog 
inputs by adjusting TimerW value (default 0x52, min. 0x50, max. 
0x60). Recommended value is 0x56 or 0x58 for NFC Forum Tag Type 1 
(Topaz). 

»> CR95HFDLL_STCMD, 01 09043A005804 

«< 0000 

REM, Recommended modulation and gain is OxDl or 0xD3 for NFC Forum 
Tag Type 1 (Topaz). 

»> CR95HFDLL_STCMD, 01 0904680101D1 

«< 0000 

REM, last Byte x7 or x8 in CR95HFDLL_SENDRECV command number of 
bits in the 14443 _Type A frame 

REM, REQA reply ATQA 000C 

»> CR95HFDLL_STCMD, 01 04 02 26 07 

«< 80 05 000C 280000 

REM, RID reply HR0 HRl UID0 UID 1 UID2 UID3 
»> CR95HFDLL_STCMD, 01 04 08 78000000000000 A8 
«< 80 0B 11 48 6E567A00 3E45 080000 

REM, RAll 0408 0000 UID0 UID 1 UID2 UID3 Reply HR0 HRl UID0 UID 1 
UID2 UID3 datas 

»> CR95HFDLL_STCMD, 01 04 08 000000 6E567A00 A8 
«< 80 40 11 48 6E567A00 

0002250000100E000313D1010F5402656E557365204352393552462021000000000 
0000000000000000000000000000000000000000000CCCCCC 

REM, Read ad08 00 UID0 UID 1 UID2 UID3 

»> CR95HFDLL_STCMD, 01 04 08 01 0800 6E567A00 A8 

«< 80 07 08 00 87C1 080000 

REM, Write_E ad08 data 12 UID0 UID 1 UID2 UID3 

»> CR95HFDLL_STCMD, 01 04 08 53 0812 6E567A00 A8 

«< 80 07 08 12 14F2 080000 

REM, Read ad08 00 UID0 UID 1 UID2 UID3 

»> CR95HFDLL_STCMD, 01 04 08 01 0800 6E567A00 A8 

«< 80 07 08 12 14F2 080000 

REM, Write_NE ad08 data A5 UID0 UID 1 UID2 UID3 

»> CR9 5HFDLL_STCMD, 01 04 08 1A 08A5 6E567A00 A8 

«< 80 07 08 B7 B300 080000 

REM, Read ad08 00 UID0 UID 1 UID2 UID3 

»> CR95HFDLL_STCMD, 01 04 08 01 0800 6E567A00 A8 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


«< 80 07 08 B7 B300 080000 

REM, Write_E ad08 data 00 UID0 UID 1 UID2 UID3 

»> CR95HFDLL_STCMD, 01 04 08 53 0800 6E567A00 A8 

«< 80 07 08 00 87C1 080000 

REM, Read ad08 00 UID0 UID 1 UID2 UID3 

»> CR95HFDLL_STCMD, 01 04 08 01 0800 6E567A00 A8 

«< 80 07 08 00 87C1 080000 

D.1.2 NFC Forum Tag Type 2 

REM, CR95HF code example to support NFC Forum Tag Type 2 14443_A 
REM, TEST INVENTORY then Read & Write in Memory 

REM, Protocol select 14443A 
»> CR95HFDLL_STCMD, 01 02020200 
«< 0000 

REM, Optimization of synchronization between digital and analog 
inputs by adjusting TimerW value (default 0x52, min. 0x50, max. 
0x60). Recommended value is 0x56 or 0x58 for NFC Forum Tag Type 2. 

»> CR95HFDLL_STCMD, 01 09043A005804 

«< 0000 

REM, Recommended modulation and gain is OxDl or 0xD3 for NFC Forum 
Tag Type 2. 

»> CR95HFDLL_STCMD, 01 0904680101D1 

«< 0000 

»> CR9 5HFDLL_ANTICOLSELECT12 3 

- IS014443-A STARTING ANTICOLLISION ALGORITHM - 

IS014443-A REQAreply ATQA 

»> CR9 5HFDLL_SENDRECV, 26 07 

«< 80 05 4400 280000 

IS014443-A ANTICOL 1 

>» CR9 5HFDLL_SENDRECV, 93 20 08 

«< 80 08 8804179F04 280000 

IS014443-A SELECT 1 

»> CR95HFDLL_SENDRECV, 93 70 8804179F04 28 
«< 80 06 04 DA17 080000 
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CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


IS014443-A ANTICOL 2 
>» CR95HFDLL_SENDRECV, 9520 08 
«< 80 08 7910000069 280000 
IS014443-A SELECT 2 

»> CR95HFDLL_SENDRECV, 9570 7910000069 28 
«< 80 06 00 FE51 080000 

--> UID = 04179F10000069 

--> TAG selected 

- IS014443-A END OF ANTICOLLISION ALGORITHM - 

REM, READ @A5 

»> CR9 5HFDLL_SENDRECV, 300C 2 8 

«< 80 15 00000000FFFFFFFFFFFFFFFFFFFFFFFF F4CD 080000 

REM, WRITE @0C data A5 

»> CR95HFDLL_SENDRECV, A20CA5A5A5A5 28 
<<< 87 00 : Frame wait time out OR no tag 
REM, READ @A5 

»> CR9 5HFDLL_SENDRECV, 300C 2 8 

«< 80 15 A5A5A5A5FFFFFFFFFFFFFFFFFFFFFFFF 84D8 080000 

D.1.3 NFC Forum Tag Type 2 or 4: Using split frames to resolve collisions 

REM, TEST ANTICOLISION 2 tags 14443_A 
REM, CR95HF CONFIGURATION : IS014443-A protocol 
»> CR95HFDLL_SELECT, 02000280 
«< 0000 

REM, IS014443-A : CONFIG 

»> CR95HFDLL_STCMD, 01 09043A005A04 

«< 0000 

REM, IS014443-A : INCREASE DEMOD GAIN 
»> CR95HFDLL_STCMD, 01 090468010IDF 

«< 0000 


REM, Anticollision 2 tags 

REM, Tag 1 --> UID = 044B744AEF2280 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


REM, Tag 2 —> UID = 043B114AEF2280 

REM, Response When 2 tags are present NVB = nb Byte OK + nb bit OK 
REM, Collision B8 

REM, First Byte Coll 02 (3 eme Byte) (8804 ok) 

REM, Index bit Coll 04 (5eme bit) => SN finish by 0 or 1 
REM, set NVB = 45 

REM, REQA Poll field with Two tags In operating volume 
»> CR95HFDLL_STCMD, 01 04022607 
«< 80 05 4403 280000 

REM, Ant CL1 Collision Detection (NVB 20) none data on UID 
REM, Response Flag Fl=B8 F2=02 F3=04 

REM, Fl=B8 collision detected 8 bits significatifs in first byte of 
response 

REM, F2=02 collision detected in 3rd response byte, index start at 
0 

REM, F3=04 collision detected on 5th bit, index start at 0 
»> CR95HFDLL_STCMD, 01 0403932008 
«< 80 08 88047B75B7 B80204 

REM, Collision Management Usage of split frame with NVB = 45 4bytes 
OK + 5 lsb bit OK in next byte 

REM, last bit (collision one) arbitrary fixed to select only one 
branch of UID tree 

REM, padding of last byte with zeros as msb (tranmission lsb first) 
0B 

REM, command flag 45 usage of Split Frame (4) with 5 bits 
significatif in last byte 

REM, uncomplete response byte is padded with 0 as lsb bits 
REM, Response Flag Fl=23 F2=00 F3=00 

REM, Fl=23, No collision 

REM, 3 bit significatif (msb last received bits) in first response 
byte 40 

REM, F2=00, not significant 
REM, F3=00, not significant 
»> CR95HFDLL_STCMD, 01 0406934588040B45 



62/77 


DoclD018669 Rev 12 




CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


«< 80 06 4074B3 230000 
REM, Activation tag Highest branch 
»> CR95HFDLL_SENDRECV, 937088044B74B328 
«< 80 06 24D836 080000 

REM, Ant CL2 

»> CR95HFDLL_STCMD, 01 0403952008 
«< 80 08 4AEF228007 2 80000 

REM, Sel CL2 tag Highest branch 
»> CR95HFDLL_SENDRECV, 95704AEF22800728 

«< 80 06 20FC70 080000 

REM, IS014443-A HLTA tagl Highest branch 

»> CR95HFDLL_SENDRECV, 50002 8 

<<< 8700 : Frame wait time out OR no tag 

REM, WUPA Second tags In field 
»> CR95HFDLL_STCMD, 01 04025207 
«< 80 05 4403 280000 

REM, Ant CL1 Detection Collision second tag (No collision) 
»> CR95HFDLL_STCMD, 01 0403932008 
«< 80 08 88047B75B7 B80204 

REM, Activation tag lowest branch 043B114AEF2280 
»> CR95HFDLL_SENDRECV, 937088043B11A6789808 
«< 80 06 24D836 080000 
REM, Ant CL2 

»> CR95HFDLL_STCMD, 01 0403952008 
«< 80 08 4AEF228007 2 80000 

REM, Sel CL2 tag Highest branch 
»> CR95HFDLL_SENDRECV, 95704AEF22800728 

«< 80 06 20FC70 080000 

REM, IS014443-A HLTA tag2 Lowest branch 

»> CR95HFDLL_SENDRECV, 50002 8 

<<< 8700 : Frame wait time out OR no tag 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


REM, REQA no other tag In operating volume 
»> CR95HFDLL_STCMD, 01 04022607 
«< 8700 

D.1.4 NFC Forum Tag Type 2 

Communication using Parity Framing mode which is compliant with Ml FARE® framing 
requirements. 

REM, TEST Extract NDEF Message of NFC Tag Type 2 using Parity 
Framing mode option 


REM, IS014443-A protocol select 
»> 02000280 
«< 0000 

REM, IS014443-A configuration 
»> 09043A005A04 
«< 0000 

REM, IS014443-A: Increase modulation and gain 
»> 0904680101DF 
«< 0000 

REM, REQA 

»> 04 02 26 07 

«< 80 05 4400 280000 

REM, Ant CL1 
»> 04 03 93 20 08 
«< 80 08 8804CB8CCB 280000 
REM, Sel CLl 

»> 04 08 9370 8804CB8CCB 28 
«< 80 06 04 DA17 080000 
REM, Ant CL2 
»> 04 03 9520 08 
«< 80 08 1A432880F1 280000 
REM, Sel CL2 

»> 04 08 9570 1A432880F1 28 
<<< 80 06 00 FE51 080000 
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CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


REM, All commands below are sent using Parity Framing mode option 
which defines the parity bit value coming with data byte. 

REM, All commands byte including CRC are sent or received in format 
Data Byte Parity Byte. 

REM, Special case occur when receiving single nibble for ACK (9004 
0A 2400) or NAK (9004 Oy 2400) where 'y' depends on error code. 

REM, RowO SN0 SNl SN2 BCC0 

REM, Read ROWO option (cmd CRC1 addr CRC1 CRC2) Parity 
automatically included 

REM, response Result code Length Data Status 

»> 04 05 30 00 02 A8 08 

«< 80 15 04 CB 8C CB 1A 43 28 80 Fl 48 00 00 El 10 12 00 CF2F 080000 

REM, Read ROWO option Parity Framing (cmd CRC1 addr CRC1 CRC2) 
Parity specify after each byte 

REM, response Result code Length Data (data byte+parity byte) Status 
»> 04 09 3080 0080 0200 A800 18 

«< 80 27 04 00 CB 00 8C 00 CB 00 1A 00 43 00 28 80 80 00 Fl 00 48 80 00 80 0 080 

El 80 10 00 12 80 00 80 CF 80 2F 00 080000 


REM, Read ROWO option Parity Framing (cmd CRC1 addr CRC1 CRC2) 
with error in Parity 

REM, Response Result code Length Data (data byte+parity byte) Status 
REM, NACK 

REM, CR9 5HFDLL_STCmd 
REM, CR9 5HFDLL_STCmd 

REM, Read R0W1_9 option Parity Framing (cmd CRC1 addr CRC1 CRC2) 
Parity specify after each byte REM 

REM, Rowl SN3 SN4 SN5 SN6 

»> 04 09 3080 0100 8B80 B900 18 

«< 8027 1A00 4300 2880 8000 F100 4880 0080 0080 E180 1000 1280 0080 
0100 0380 A080 1000 1880 7A00 080000 

REM, Row2 BCC1 internal lock byteO lock bytel 

»> 04 09 3080 0200 1000 8B80 18 

«< 8027 F100 4880 0080 0080 E180 1000 1280 0080 0100 0380 A080 1000 
4480 0380 0B00 D180 A580 4C00 080000 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


REM, Row3 CCFile Magic El Ver 10 MMY Size 12 Access 00 

»> 04 09 3080 0380 9980 9A80 18 

«< 8027 E180 1000 1280 0080 0100 0380 A080 1000 4480 0380 0B00 D180 
0100 0700 5580 0100 8880 1300 080000 

REM, Row4 First TL (T01 Prop L 3 V) 

»> 04 09 3080 0400 2600 EE80 18 

«< 8027 0100 0380 A080 1000 4480 0380 0B00 D180 0100 0700 5580 0100 
7300 7480 2E80 6380 5A80 2A00 080000 

REM, Row5 Second TLV NDEF MSG (T03 L 0B V www.st.com) 

»> 04 09 3080 0580 AF80 FF80 18 

«< 8027 4480 0380 0B00 D180 0100 0700 5580 0100 7300 7480 2E80 6380 
6F80 6D00 FE00 0080 3F80 8500 080000 

REM, Row6 Second TLV NDEF MSG ( T V www.st.com) 

»> 04 09 3080 0680 3400 CD00 18 

«< 8027 0100 0700 5580 0100 7300 7480 2E80 6380 6F80 6D00 FE00 0080 
0080 FF80 0080 FF80 3F80 F680 080000 

REM, Row7 Secobd TLV NDEF MSG (T V www.st.com) 

»> 04 09 3080 0700 BD80 DC00 18 

«< 8027 7300 7480 2E80 6380 6F80 6D00 FE00 0080 0080 FF80 0080 FF80 
4500 7300 7300 6100 4880 CB00 080000 

REM, Row8 Third TLV Terminator (T V FE 00) 

»> 04 09 3080 0800 4A00 2480 18 

«< 8027 6F80 6D00 FE00 0080 0080 FF80 0080 FF80 4500 7300 7300 6100 
0080 FF80 0080 FF80 F080 4B80 080000 

REM, Row9 Read Scratch pad 

»> 04 09 3080 0980 C380 3580 18 

«< 8027 0080 FF80 0080 FF80 4500 7300 7300 6100 0080 FF80 0080 FF80 
4500 4600 2000 5400 9A80 4880 080000 


REM, Write ROW9 option Parity Framing (cmd CRC1 addr CRC1 CRC2) 
Parity specify after each byte 
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CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


REM, Response Result code Length Data (data byte+parity byte) Status 
REM, Row9 Write Scratch pad (ACK) 

»> 04 11 A200 0980 AA80 5580 AA80 5580 2900 7D80 18 

«< 90 04 0A 240000 

REM, Row9 Read Scratch pad 

»> 04 09 3080 0980 C380 3580 18 

«< 8027 AA80 5580 AA80 5580 4500 7300 7300 6100 0080 FF80 0080 FF80 
4500 4600 2000 5400 1780 B480 080000 

REM, Row9 Write Scratch pad (ACK) 

»> 04 11 A200 0980 0080 FF80 0080 FF80 C800 2780 18 

«< 90 04 0A 240000 

REM, Row9 Read Scratch pad 

»> 04 09 3080 0980 C380 3580 18 

«< 8027 0080 FF80 0080 FF80 4500 7300 7300 6100 0080 FF80 0080 FF80 
4500 4600 2000 5400 9A80 4880 080000 

REM, Select Sector 0 (NACK) 

»> 04 09 C200 FF80 C200 E880 18 

«< 90 04 00 240000 

BREAK 

»> CR9 5HFDLL_RESET_SPI 
«< 8000 

»> CR9 5HFDLL_ECHO 
«< 5500 

»> CR95HFDLL_IDN 

«< 00 OF 4E46 4320 4653 324A 4153 5434 002ACE 

D.1.5 NFC Forum Tag Type 4A 

**** CR95HF code example to support NFC Forum Tag Type 4A (14443-A) 

& NDEF message 

REM, 14443B (CR95HF Protocol Selection 14443_A) 

REM, first Byte 01 in CR95HFDLL_STCMD is only requested by CR95HF 
Development SW 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


********** CR95HF setting to support extended Frame Waiting Time 

kkkkkkkkkk 

>» CR95HFDLL_STCMD, 01 020402000180 

«< 0000 

REM, Optimization of synchronization between digital and analog 
inputs by adjusting TimerW value (default 0x52, min. 0x50, max. 
0x60). Recommended value is 0x56 or 0x58 for NFC Forum Tag Type 1 
(Topaz). 

»> CR95HFDLL_STCMD, 01 09043A005804 

«< 0000 

REM, Recommended modulation and gain is OxDl or 0xD3 for NFC Forum 
Tag Type 1 (Topaz). 

»> CR95HFDLL_STCMD, 01 090468010 lDl 

«< 0000 

REM, last Byte x7 or x8 in CR95HFDLL_SENDRECV command number of 
bit in the 14443 _Type A frame 

»> CR9 5HFDLL_ANTICOLSELECT12 3 


- IS014443-A STARTING ANTICOLLISION ALGORITHM 

IS014443-A REQA 

»> CR9 5HFDLL_SENDRECV, 26 07 

«< 80 05 0400 280000 

IS014443-A ANTICOL 1 

>» CR95HFDLL_SENDRECV, 9320 08 

«< 80 08 08192D A29E 280000 

IS014443-A SELECT 1 

»> CR95HFDLL_SENDRECV, 937008192DA29E 28 
«< 80 06 20 FC70 080000 
—> UID = 192DA29E , TAG selected 

- IS014443-A END OF ANTICOLLISION ALGORITHM - 


*** IS014443A_4 RATS/ATS (bit rate capability/FDT/CID usage) 

»> CR95HFDLL_SENDRECV, E050 28 
«< 80 0A 057833B003 A0F8 080000 


****** IS014443A_4 PPS (Protocol parameter data rate) 

»> CR95HFDLL_SENDRECV, D01100 28 
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CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


«< 80 06 DO 7387 080000 


** IS014443_4 APDU (command & reply are using Iblock format, 

Prolog Information (APDU) Epilog) 

*** 7816_ APDU format (Class Instruction, Param , Length cmd data 
Length expeted) 

*** last byte 28 is a control byte to request CR95HF to 
automatically happen CRC as Epilog 

*** In response first 2 Byte 80 xx and last three bytes 08 0000 are 
CR95HF's control bytes 

*** Detect & Access NDEF Message 

*** Select Application by name 

»> CR95HFDLL_SENDRECV, 02 00 A4040007D2760000850100 28 

«< 80 08 02 9000 FI09 080000 


******************* Select CC File by name 

»> CR95HFDLL_SENDRECV, 03 00 A4000002E103 28 

«< 80 08 03 9000 2D53 080000 


******************* ReadBinary CC (offset Le) 

»> CR95HFDLL_SENDRECV, 02 00 B000000F 28 

«< 80 17 02 000F1000FF00FF0406000100FF0000 9000 B755 080000 


******************* Select NDEF MSG by Identifier 0001 

»> CR95HFDLL_SENDRECV, 03 00 A40000020001 28 

«< 80 08 03 9000 2D53 080000 


******************* ReadBinary NDEF MSG (MSG Length offset 00 2 

bytes) 

»> CR95HFDLL_SENDRECV, 02 00 B0000002 28 

«< 80 0A 02 0015 9000 ABB3 080000 


******************* Select NDEF File by name 

»> CR95HFDLL_SENDRECV, 03 00 A40000020001 28 
«< 80 08 03 9000 2D53 080000 


■k-k-k-k-k-k-k-k-k-k-k-k'k-k'k-k'k'k-k 


ReadBinary NDEF (MSG offset 02 , 20 Bytes) 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


»> CR95HFDLL_SENDRECV, 02 00 B0000215 28 

«< 80 ID 02D101115402656E4D32344C52313620747970652034 9000 25C5 080000 


*** Header Dl type 01 Payload 11 type 54 status 02 english 656E 

, MSG : M24LR16 type 


D.2 ISO/IEC 14443 Type B 

D.2.1 NFC Forum Tag Type 4B 

**** CR95HF code example to support NFC Forum Tag Type 4B (14443-B) 
& NDEF message 

REM, Check CR95HF setting & Protocol selection 
REM, FIELD OFF 

REM, first Byte 01 in CR95HFDLL_STCMD is only requested by CR95HF 
Development SW 

»> CR95HFDLL_STCMD, 01 02020000 

«< 0000 

REM, 14443B (CR95HF PROTOCOL Selection 14443_B 
»> CR95HFDLL_STCMD, 01 020403010180 
«< 0000 

REM, 14443B Optimization CR95HF Analog Configuration for 144443 
(0x30) 

»> CR95HFDLL_STCMD, 01 090468010130 

«< 0000 


REM, Access to NFC FORUM TAG Type 4B 

REM, REQB Ox 050000 + CRC_B (APf AFI Param (slotO)) 

REM, Reply ATQB 0x50 4Bytes 4 Bytes 3 Bytes + CRC_B (PUPI AppliData 
Protocol Info) 

REM, Reply from CR95HF 80 OF 50AABBCCDD30ABAB010081E1AE00 00 

REM, 80 response OK, OF nb byte response including tag reply and the 
ultimate CR95HF status byte 00 (reply OK) 

REM, Tag reply 50AABBCCDD3 0ABAB010 0 81E1AE0 0 

REM, Response code 50 

REM, Pupi AABBCCDD 

REM, AFI 30 access control 
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CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


REM, 

CRC_B(AID) ABAB 

REM, 

Nb Appli (1) 01 

REM, 

Prot Info bytel 00 (106 Kbps both direction) 


REM, Prot Info byte 2 81( frame max 256 Bytes ISO compliant 

0081E1AE0000 

REM, Prot Info byte 3 El (Max frame wait time 4.9 ms Appli 
proprietary CID supported) 


REM, 

CRC_B AE00 

REM, 

14443_3 

REM, 

REQB .... 


»> CR95HFDLL_STCMD, 01 04 03 050000 
«< 80 OF 50AABBCCDD3 0ABAB01008lEl AE00 00 

REM, ATTRIB OxlD PUPI lbyte lbyte lbyte 1 byte + CRC_B (ID 
Identifier Paraml Param2 Param3 Param4) 


REM, 

Paraml 00 use default TR0 TR1 use EOF 

REM, 

Param2 07 max frame size 106 Kbps Up & Dwn link 

REM, 

Param3 01 IS014443 compliant 

REM, 

Param4 08 CID (8) card Identifier 

REM, 

reply CR95HF 80 04 18EBC3 00 


REM, 80 response OK 04 nb byte response including ultimate byte 
00 CR95HF reply OK 


REM, 

Reply 10F9E0 coefBufferLength 1 CID 1 + CRC_B 

REM, 

ATTRIB ....CID0 


»> CR95HFDLL_STCMD, 01 04 09 ID AABBCCDD00070100 
«< 80 04 10 F9E0 00 

REM, 14443_4 , CID not used 

REM, APDU for NDEF management 

REM, command format (INF) CLA INS Pi P2 Lc(optional 
Data(optional) 


REM, 

Response (optional ): body (optional) Swl sW2 

REM, 

Block Format Prolog INFO Epilog ( 02 [CID] [NAD] [INF] CRC_B 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


REM, Sequence lecture NDEF ( for all following commands CRC_B is 
automatically appends by CR95HF) 

REM, Select application suivant la version du tag (100) 

»> CR95HFDLL_SENDRECV, 02 00 A4 040007D2760000850100 

«< 80 06 029000296A 00 
REM, response 90 00 ok 

REM, response 6A 82 application not found 
REM, Select CC 

»> CR95HFDLL_SENDRECV, 03 00 A4 0000 02 El03 
«< 80 06 03 9000 F530 00 
REM, Read CC 

»> CR95HFDLL_SENDRECV, 02 00 B0 0000 OF 

«< 80 15 02 000F1000FF00FF0406000110020000 9000 E7FA 00 

REM, Select Ndef 0001 

»> CR95HFDLL_SENDRECV, 03 00 A4 0000 02 0001 

«< 80 06 03 9000 F530 00 
REM, Read Msg Length 

»> CR95HFDLL_SENDRECV, 02 00 B0 0000 02 
«< 80 08 02 0013 9000 53AA 00 
REM, Select Ndef 0001 

»> CR95HFDLL_SENDRECV, 03 00 A4 0000 02 0001 
«< 80 06 03 9000 F530 00 
REM, Read Message 

»> CR95HFDLL_SENDRECV, 02 00 B0 0002 13 

«< 80 19 02 D1010F5402656E557365204352393548462021 9000 8571 00 

D.3 ISO/IEC 18092 

D.3.1 NFC Forum Tag Type 3 

REM, CR95HF code example to support NFC Forum Tag Type 3 
REM, TEST INVENTORY ISO/IEC 18092 
REM, RFOFF 

»> CR95HFDLL STCMD, 01 02020000 
«< 0000 
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CR95HF Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


REM, Select Protocol 14443C 
»> CR95HFDLL_STCMD, 01 02020451 
«< 0000 

REM, ISO/IEC 18092 New Modulation and Gain 0x50 
»> CR95HFDLL STCMD, 01 090468010150 
«< 0000 

REM, ISO/IEC 18092 Enable AutoDetect Filter to synchronize NFC Forum Tag Type 3 with 
CR95HF device 

»> CR95HFDLL STCMD, 01 09040A0102A1 
«< 0000 

REM, REOC 00 FFFF 00 00 (command code System code No request slot 0) 

REM, ATOC 80 12 01 010102148E0DB413 (Manuf ID) 100B4B428485D0FF (Manuf 
Parameter) 

»> CR95HFDLL_STCMD, 01 04 05 00FFFF0000 
«< 80 12 01 010102148E0DB413 100B4B428485D0FF 00 

D.4 ISO/IEC 15693 

D.4.1 ISO/IEC 15693 tag 

REM, Test Tag ISO/IEC 15693 (LR family) 

REM, Protocol Selection Up link Ask 30% coding 1/4 
REM, Down link Single Sub carrier High data rate 
REM, Inventory One Slot 

REM, Command Protocol Select 02 02 01 05 

REM, Protocol Selection 
»> CR95HFDLL_STCMD, 01 02020105 
«< 0000 

REM, Modification of IndexMod & Gain in Analog Value register 
@69_indexl 0x50 

»> CR95HFDLL_STCMD, 01 090468010150 
«< 0000 

REM, Inventory 1 Slot 

»> CR95HFDLL_STCMD, 01 0403 260100 
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Examples of CR95HF command code to activate NFC Forum and ISO/IEC 15693 tags 


CR95HF 


«< 80 0D 0000B7100128B42102E0 66CC 00 

REM, GetSystem Info 

REM, Flags, UID E00221B4280110B7 DSFID 00 AFI 00 MemorySize 3F 
BlockSize 03 IC Reference 21 

»> CR95HFDLL_SENDRECV, 02 2B 

«< 80 12 00 OF B7100128B42102E000003F03 21 DFB0 00 

REM, Test Tag ISO/IEC 15693 (Dual family) 

REM, Protocol Selection Up link Ask 30% coding 1/4 
REM, Down link Single Sub carrier High data rate 
REM, Inventory 1 Slot 

REM, Command Protocol Select 02 02 01 05 


REM, Protocol Selection 
»> CR95HFDLL_STCMD, 01 02020105 
«< 0000 


REM, Modification of IndexMod & Gain in Analog Value register 
@69_indexl 0x50 

»> CR95HFDLL_STCMD, 01 090468010150 
«< 0000 


REM, Inventory 1 Slot 

»> CR95HFDLL_STCMD, 01 0403 260100 

«< 80 0D 00FF07062092132C02E0 3D22 00 

REM, GetSystem Info 

REM, Flags ,UID E0022C1392200607 DSFID FF AFI 00 MemorySize 07FF 
BlockSize 03 IC Reference 2C 


»> CR95HFDLL_SENDRECV, 0A2B 

«< 80 13 00 OF 07062092132C02E0 FF 00 FF07 03 2C 984D 00 
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characteristics on page 43 and updated Section 6.3: Power 
consumption characteristics on page 43. 

06-Jan-2012 

5 

Updated Table 12: List of <Parameters> values for the 
ProtocolSelect command for different protocols on page 21, 

Table 17: Idle command description on page 31 and 

Section 5.6.5: Tag detection calibration procedure. 

Updated Section 6.3: Power consumption characteristics, 

Section 6.4: SPI characteristics and Section 6.5: RF 
characteristics. 

Updated Appendix B: Example of tag detection calibration 
process and Appendix C: Example of tag detection command 
using results of tag detection calibration. 

04-May-2012 

6 

Updated Table 3: CR95HF operating modes and states on 
page 11. 

Updated response to IDN command in Section 5.3. 

Added additional features in Section 5.8: Write Register 
(WrReg) command (0x09) description. 

Added optional parameter to increase maximum waiting time in 
NFC Forum Tag Type 3. 

Updated Section 6.3: Power consumption characteristics and 
added enhanced command for reducing consumption. 

07-Jun-2012 

7 

Updated Section 6.3: Power consumption characteristics and 
enhanced command (HF2RF bit) for reducing consumption. 

24-Jul-2012 

8 

Changed Response example to Command example in Table 14: 
List of <Data> Send values for the SendRecv command for 
different protocols. 

Updated Table 2: CR95HF pin descriptions. 

09-Jun-2014 

9 

Updated Section 3.2: Startup sequence and Table 28: Absolute 
maximum ratings on page 42. 

10-0ct-2014 

10 

Corrected reporting of 4-bit frames in ISO/IEC 14443-A mode. 
Internal data exchange buffer is now 528 bytes. Now able to 
directly manage the value of Parity bit included in a standard 
ISO/IEC 14443-A frame. Added optional parameters for use in 
Protocol Select command. Mains supply extended to 5V range. 
Added enhanced error code list. 
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Table 40. Document revision history (continued) 


Date 

Revision 

Changes 

09-Nov-2016 

11 

Updated: 

- Features 

- Table 6: Possible error codes and their meaning 

- Table 19: Summary of Idle command parameters 

- Section 1: Package information 

- Figure 17: VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very 
thin profile fine pitch quad flat package outline 

- Table 36: VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very 
thin profile fine pitch quad flat package mechanical data 

Added: 

- Figure 18: VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very 
thin profile fine pitch quad flat package recommended 
footprint 

08-Jun-2017 

12 

Updated: 

- Table 36: VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very 
thin profile fine pitch quad flat package mechanical data 

- Figure 18: VFQFPN32 - 32-pin, 5x5 mm, 0.5 mm pitch very 
thin profile fine pitch quad flat package recommended 
footprint 
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IMPORTANT NOTICE - PLEASE READ CAREFULLY 


STMicroelectronics NV and its subsidiaries (“ST”) reserve the right to make changes, corrections, enhancements, modifications, and 
improvements to ST products and/or to this document at any time without notice. Purchasers should obtain the latest relevant information on 
ST products before placing orders. ST products are sold pursuant to ST’s terms and conditions of sale in place at the time of order 
acknowledgement. 


Purchasers are solely responsible for the choice, selection, and use of ST products and ST assumes no liability for application assistance or 
the design of Purchasers’ products. 


No license, express or implied, to any intellectual property right is granted by ST herein. 


Resale of ST products with provisions different from the information set forth herein shall void any warranty granted by ST for such product. 


ST and the ST logo are trademarks of ST. All other product or service names are the property of their respective owners. 


Information in this document supersedes and replaces information previously supplied in any prior versions of this document. 


©2017 STMicroelectronics - All rights reserved 
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